Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
NetRisk 1.9.7 - Cross-Site Scripting / SQL Injection
CVE-2008-0185—webappsphp
SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2011-5161
CVE-2011-5161—
Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2011-5165
CVE-2011-5165—
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗
Referência
CVE-2017-3881
CVE-2017-3881CRITICALunder attack
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
100RISK
open ↗
Referência✓ VexDay Proof
Ocean12 Mailing List Manager Gold - File Disclosure / SQL Injection / Cross-Site Scripting
CVE-2008-5980—webappsphp
Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allow
23RISK
open ↗
Referência✓ VexDay Proof
IncCMS Core 1.0.0 - 'settings.php' Remote File Inclusion
CVE-2006-5304—webappsphp
PHP remote file inclusion vulnerability in inc/settings.php in IncCMS Core 1.0.0 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-18600
CVE-2026-18600HIGH
GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection
41RISK
open ↗
Referência✓ VexDay Proof
Tuned Studios Templates - Local File Inclusion
CVE-2008-0231—webappsphp
Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange C
23RISK
open ↗
Referência
CVE-2009-4905
CVE-2009-4905—
Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to
23RISK
open ↗
Referência
CVE-2026-46333
CVE-2026-46333HIGH
ptrace: slightly saner 'get_dumpable()' logic
56RISK
open ↗
Referência
CVE-2009-4925
CVE-2009-4925—
Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16,
23RISK
open ↗
Referência
CVE-2011-5173
CVE-2011-5173—
Buffer overflow in Bugbear Entertainment FlatOut 2005 allows user-assisted remote attackers to cause a denial of service
23RISK
open ↗
Referência
CVE-2013-5758
CVE-2013-5758—
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by
28RISK
open ↗
Referência
CVE-2016-3943
CVE-2016-3943—
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
23RISK
open ↗
Referência
CVE-2013-5977
CVE-2013-5977—
Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordP
23RISK
open ↗
Referência
CVE-2016-4204
CVE-2016-4204—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RISK
open ↗
Referência
CVE-2016-4206
CVE-2016-4206—
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RISK
open ↗
Referência
CVE-2026-7238
CVE-2026-7238MEDIUM
code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-7237
CVE-2026-7237MEDIUM
AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal
33RISK
open ↗
Referência
CVE-2026-7235
CVE-2026-7235MEDIUM
ErlichLiu claude-agent-sdk-master route.ts path traversal
33RISK
open ↗
Referência
CVE-2026-7234
CVE-2026-7234MEDIUM
BrowserOperator browser-operator-core server.js startsWith path traversal
33RISK
open ↗
Referência
CVE-2026-7233
CVE-2026-7233MEDIUM
Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds
33RISK
open ↗
Referência
CVE-2026-7226
CVE-2026-7226MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection
33RISK
open ↗
Referência
CVE-2026-7225
CVE-2026-7225MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection
33RISK
open ↗
Referência
CVE-2026-7224
CVE-2026-7224MEDIUM
SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection
33RISK
open ↗
Referência
CVE-2026-7223
CVE-2026-7223MEDIUM
BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery
33RISK
open ↗
Referência
CVE-2016-4231
CVE-2016-4231—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗
Referência
CVE-2026-15250
CVE-2026-15250MEDIUM
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
33RISK
open ↗
Referência
CVE-2018-1000001
CVE-2018-1000001—
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RISK
open ↗
Referência
CVE-2009-3975
CVE-2009-3975—
SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 481 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.