Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,325 exploits

Referência

CVE-2026-90493

CVE-2026-90493CRITICAL

Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

48RISK

open ↗

Referência

CVE-2026-15751

CVE-2026-15751MEDIUM

mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal

33RISK

open ↗

Referência✓ VexDay Proof

Check Point Firewall-1 - PKI Web Service HTTP Header Remote Overflow

CVE-2009-1227—doshardware

NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI

23RISK

open ↗

Referência✓ VexDay Proof

Teraway LinkTracker 1.0 - Insecure Cookie Handling

CVE-2009-1617—webappsphp

Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&l

23RISK

open ↗

Referência

CVE-2011-1665

CVE-2011-1665—

PHPBoost 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attac

23RISK

open ↗

Referência

CVE-2012-5242

CVE-2012-5242—

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to

23RISK

open ↗

Referência

CVE-2009-4467

CVE-2009-4467—

misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail actio

23RISK

open ↗

Referência

CVE-2009-2327

CVE-2009-2327—

Cross-site scripting (XSS) vulnerability in add_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated

23RISK

open ↗

Referência

CVE-2018-11670

CVE-2018-11670—

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Konqueror 3.5.9 - 'load' Remote Crash

CVE-2008-5698—doslinux

HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (

23RISK

open ↗

Referência

CVE-2017-9129

CVE-2017-9129—

The wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to c

23RISK

open ↗

Referência✓ VexDay Proof

MiniHTTPServer Web Forum & File Sharing Server 4.0 - Add User

CVE-2006-5597—remotewindows

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accou

23RISK

open ↗

Referência

CVE-2024-27620

CVE-2024-27620HIGH

An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request

41RISK

open ↗

Referência

CVE-2024-28000

CVE-2024-28000CRITICAL

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RISK

open ↗

Referência

CVE-2026-19069

CVE-2026-19069MEDIUM

itsourcecode Hospital Management System treatmentrecord.php sql injection

33RISK

open ↗

Referência

CVE-2026-86815

CVE-2026-86815MEDIUM

BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes

33RISK

open ↗

Referência✓ VexDay Proof

ScarNews 1.2.1 - 'sn_admin_dir' Local File Inclusion

CVE-2007-1932—webappsphp

Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

My Little Forum 1.7 - 'user.php?id' SQL Injection

CVE-2007-2942—webappsphp

SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

DreamLog 0.5 - 'upload.php' Arbitrary File Upload

CVE-2007-3403—webappsphp

Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload a

23RISK

open ↗

Referência

CVE-2013-6883

CVE-2013-6883—

Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allow

23RISK

open ↗

Referência

CVE-2013-6883

CVE-2013-6883—

Cross-site request forgery (CSRF) vulnerability in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allow

23RISK

open ↗

Referência✓ VexDay Proof

LinPHA 1.3.1 - 'new_images.php' Blind SQL Injection

CVE-2007-4053—webappsphp

SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2008-5322

CVE-2008-5322—

Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, wh

23RISK

open ↗

Referência✓ VexDay Proof

ASPPortal 3.2.5 - Database Disclosure

CVE-2008-6382—webappsasp

ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

SH-News 3.0 - Insecure Cookie Handling

CVE-2008-6664—webappsphp

action.php in SH-News 3.0 allows remote attackers to bypass authentication and gain administrator privileges by setting

23RISK

open ↗

Referência

CVE-2010-2689

CVE-2010-2689—

SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2018-9173

CVE-2018-9173—

Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows rem

23RISK

open ↗

Referência

CVE-2014-5284

CVE-2014-5284—

host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, whi

23RISK

open ↗

Referência

CVE-2016-5195

CVE-2016-5195HIGHunder attack

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

open ↗

Referência✓ VexDay Proof

NuralStorm Webmail 0.98b - 'process.php' Remote File Inclusion

CVE-2006-5386—webappsphp

PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.