Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2018-10814
CVE-2018-10814—
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.
23RISK
open ↗
Referência✓ VexDay Proof
Frimousse 0.0.2 - 'explorerdir.php' Local Directory Traversal
CVE-2008-0425—webappsphp
Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary fi
23RISK
open ↗
Referência
CVE-2026-16204
CVE-2026-16204MEDIUM
zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection
33RISK
open ↗
Referência
CVE-2009-4685
CVE-2009-4685—
Cross-site scripting (XSS) vulnerability in celebrities.php in PHP Scripts Now Astrology allows remote attackers to inje
23RISK
open ↗
Referência
CVE-2010-4357
CVE-2010-4357—
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-4359
CVE-2010-4359—
SQL injection vulnerability in index.php in Jurpopage 0.2.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2014-0329
CVE-2014-0329—
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account
23RISK
open ↗
Referência
CVE-2014-0476
CVE-2014-0476—
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute a
38RISK
open ↗
Referência
CVE-2010-4362
CVE-2010-4362—
Multiple SQL injection vulnerabilities in MicroNetsoft RV Dealer Website allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-49489
CVE-2026-49489HIGH
OpenCATS - SQL Injection in DataGrid sortDirection Parameter
41RISK
open ↗
Referência
CVE-2026-49489
CVE-2026-49489HIGH
OpenCATS - SQL Injection in DataGrid sortDirection Parameter
41RISK
open ↗
Referência✓ VexDay Proof
Bubbling Library 1.32 - Multiple Local File Inclusions
CVE-2008-0545—webappsphp
Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to include and execute arbi
23RISK
open ↗
Referência
CVE-2018-12114
CVE-2018-12114—
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
23RISK
open ↗
Referência✓ VexDay Proof
CandyPress eCommerce suite 4.1.1.26 - Multiple Vulnerabilities
CVE-2008-0546—webappsasp
Multiple SQL injection vulnerabilities in CandyPress (CP) 4.1.1.26, and earlier 4.1.x versions, allow remote attackers t
23RISK
open ↗
Referência
CVE-2018-12326
CVE-2018-12326—
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution
23RISK
open ↗
Referência✓ VexDay Proof
ExoPHPDesk 1.2 Final - Authentication Bypass
CVE-2008-6917—webappsphp
SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2026-63094
CVE-2026-63094HIGH
SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
41RISK
open ↗
Referência
CVE-2014-1202
CVE-2014-1202—
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a c
23RISK
open ↗
Referência
CVE-2010-4870
CVE-2010-4870—
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2009-4832
CVE-2009-4832—
The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80
23RISK
open ↗
Referência
CVE-2010-4870
CVE-2010-4870—
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2012-1258
CVE-2012-1258—
cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate
23RISK
open ↗
Referência
CVE-2012-1259
CVE-2012-1259—
Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and pos
23RISK
open ↗
Referência
CVE-2026-6621
CVE-2026-6621MEDIUM
1024bit extend-deep index.js prototype pollution
33RISK
open ↗
Referência
CVE-2017-8926
CVE-2017-8926—
Buffer overflow in Halliburton LogView Pro 10.0.1 allows attackers to cause a denial of service or possibly have unspeci
23RISK
open ↗
Referência
CVE-2026-7676
CVE-2026-7676MEDIUM
kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal
33RISK
open ↗
Referência
CVE-2026-40500
CVE-2026-40500—
3RISK
open ↗
Referência
CVE-2026-14845
CVE-2026-14845MEDIUM
NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
33RISK
open ↗
Referência
CVE-2026-14221
CVE-2026-14221LOW
Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization
28RISK
open ↗
Referência
CVE-2025-65133
CVE-2025-65133CRITICAL
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated
48RISK
open ↗
← previouspage 517 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.