Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
MaxCMS 2.0 - '/inc/ajax.asp' SQL Injection
CVE-2009-1764—webappsasp
SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2010-0964
CVE-2010-0964—
SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2010-1716
CVE-2010-1716—
SQL injection vulnerability in the Agenda Address Book (com_agenda) component 1.0.1 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2018-10809
CVE-2018-10809—
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD)
23RISK
open ↗
Referência
CVE-2018-6593
CVE-2018-6593—
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows
23RISK
open ↗
Referência
CVE-2019-18862
CVE-2019-18862—
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
23RISK
open ↗
Referência
Newgen Correspondence Management System (corms) eGov 12.0 - IDOR
CVE-2020-35737—webappsmultiple
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information
28RISK
open ↗
Referência
CVE-2012-10033
CVE-2012-10033CRITICAL
Narcissus backend.php Image Configuration Command Injection
63RISK
open ↗
Referência
CVE-2012-10033
CVE-2012-10033CRITICAL
Narcissus backend.php Image Configuration Command Injection
63RISK
open ↗
Referência
CVE-2012-10033
CVE-2012-10033CRITICAL
Narcissus backend.php Image Configuration Command Injection
63RISK
open ↗
Referência
CVE-2017-7154
CVE-2017-7154—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2026-19055
CVE-2026-19055HIGH
ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters
41RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência
CVE-2025-34074
CVE-2025-34074CRITICAL
Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write
63RISK
open ↗
Referência
CVE-2010-3144
CVE-2010-3144—
Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Ser
28RISK
open ↗
Referência
CVE-2026-18937
CVE-2026-18937CRITICAL
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
63RISK
open ↗
Referência
CVE-2016-10033
CVE-2016-10033CRITICALunder attack
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗
Referência✓ VexDay Proof
XBrite Members 1.1 - 'id' SQL Injection
CVE-2006-1694—webappsphp
SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2026-18202
CVE-2026-18202MEDIUM
JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload
33RISK
open ↗
Referência✓ VexDay Proof
XMB 1.9.6 Final - 'basename()' Remote Command Execution
CVE-2006-4191—webappsphp
Directory traversal vulnerability in memcp.php in XMB (Extreme Message Board) 1.9.6 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
File Upload Manager 1.0.6 - 'detail.asp' SQL Injection
CVE-2006-6813—webappsasp
SQL injection vulnerability in detail.asp in Mxmania File Upload Manager (FUM) 1.0.6 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Apple iTouch/iPhone 1.1.1 - '.tif' Remote Privilege Escalation 'Jailbreak'
CVE-2007-5450—remoteios
Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote at
23RISK
open ↗
Referência✓ VexDay Proof
2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting
CVE-2009-1819—webappsphp
SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2010-3151
CVE-2010-3151—
Untrusted search path vulnerability in Adobe On Location CS4 Build 315 allows local users, and possibly remote attackers
28RISK
open ↗
Referência
CVE-2010-4873
CVE-2010-4873—
Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2012-6504
CVE-2012-6504—
SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers t
23RISK
open ↗
Referência
CVE-2026-16590
CVE-2026-16590MEDIUM
WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
33RISK
open ↗
Referência
CVE-2020-35948
CVE-2020-35948CRITICAL
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated atta
53RISK
open ↗
Referência
CVE-2026-13328
CVE-2026-13328MEDIUM
TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
33RISK
open ↗
Referência
CVE-2026-16197
CVE-2026-16197MEDIUM
Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization
33RISK
open ↗
← previouspage 521 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.