Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2017-14097
CVE-2017-14097—
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below coul
28RISK
open ↗
Referência
CVE-2017-6805
CVE-2017-6805—
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read a
23RISK
open ↗
Referência
CVE-2026-103688
CVE-2026-103688CRITICAL
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2026-103382
CVE-2026-103382MEDIUM
Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
33RISK
open ↗
Referência
CVE-2022-3915
CVE-2022-3915CRITICAL
Dokan < 3.7.6 - Unauthenticated SQLi
48RISK
open ↗
Referência✓ VexDay Proof
Mambo Component MamboWiki 0.9.6 - Remote File Inclusion
CVE-2006-4282—webappsphp
PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier f
23RISK
open ↗
Referência✓ VexDay Proof
InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion
CVE-2007-5674—webappsphp
Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2010-4872
CVE-2010-4872—
SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2026-14752
CVE-2026-14752MEDIUM
mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting
33RISK
open ↗
Referência
CVE-2016-1011
CVE-2016-1011—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows
28RISK
open ↗
Referência
CVE-2016-1013
CVE-2016-1013—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows
28RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component jooget 2.6.8 - SQL Injection
CVE-2008-0829—webappsphp
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo
23RISK
open ↗
Referência✓ VexDay Proof
EQdkp 1.3.2f - 'user_id' Authentication Bypass
CVE-2008-2222—webappsphp
SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via
23RISK
open ↗
Referência✓ VexDay Proof
Link Bid Script 1.5 - Multiple SQL Injections
CVE-2008-4175—webappsphp
Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2010-2853
CVE-2010-2853—
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2026-14751
CVE-2026-14751MEDIUM
mjperpinosa stumasy search_scratch_data.php search_scratch_data sql injection
33RISK
open ↗
Referência✓ VexDay Proof
FlashGet 1.9.0.1012 - 'FTP PWD Response' SEH Stack Overflow
CVE-2008-4321—remotewindows
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2156—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to in
23RISK
open ↗
Referência
CVE-2010-2853
CVE-2010-2853—
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2023-1934
CVE-2023-1934CRITICAL
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL
48RISK
open ↗
Referência
CVE-2026-115535
CVE-2026-115535MEDIUM
gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
33RISK
open ↗
Referência
CVE-2014-9643
CVE-2014-9643—
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local users
23RISK
open ↗
Referência
CVE-2014-9643
CVE-2014-9643—
K7Sentry.sys in K7 Computing Ultimate Security, Anti-Virus Plus, and Total Security before 14.2.0.253 allows local users
23RISK
open ↗
Referência
CVE-2015-6306
CVE-2015-6306—
Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and Linux does not verify pathnames before installation actions,
23RISK
open ↗
Referência
CVE-2026-109934
CVE-2026-109934MEDIUM
Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
33RISK
open ↗
Referência✓ VexDay Proof
MySpace Resource Script (MSRS) 1.21 - Remote File Inclusion
CVE-2007-5721—webappsphp
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allo
23RISK
open ↗
Referência
CVE-2026-109933
CVE-2026-109933MEDIUM
Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
33RISK
open ↗
Referência
CVE-2026-107858
CVE-2026-107858HIGH
Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
41RISK
open ↗
Referência
CVE-2026-96533
CVE-2026-96533MEDIUM
Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL
33RISK
open ↗
Referência
CVE-2012-4265
CVE-2012-4265—
SQL injection vulnerability in category_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 498 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.