Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
idautomation bar code - ActiveX Multiple Vulnerabilities
CVE-2008-2283—remotewindows
IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the (1) SaveBarCode and (2) SaveEn
23RISK
open ↗
Referência
CVE-2026-15234
CVE-2026-15234MEDIUM
Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute
33RISK
open ↗
Referência
Microsoft Windows Server 2025 Hyper-V NT Kernel Integration VSP - Elevation of Privilege
CVE-2025-21333HIGHunder attacklocalwindows
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
76RISK
open ↗
Referência
CVE-2026-15262
CVE-2026-15262MEDIUM
Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column
33RISK
open ↗
Referência
CVE-2026-118438
CVE-2026-118438MEDIUM
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
33RISK
open ↗
Referência
CVE-2026-100907
CVE-2026-100907MEDIUM
Eyeplus p2pcam Service snapshot information disclosure
33RISK
open ↗
Referência
CVE-2026-118437
CVE-2026-118437LOW
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
28RISK
open ↗
Referência
CVE-2026-12696
CVE-2026-12696MEDIUM
wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field
33RISK
open ↗
Referência
CVE-2026-108609
CVE-2026-108609MEDIUM
JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter
33RISK
open ↗
Referência
CVE-2026-120597
CVE-2026-120597MEDIUM
Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
33RISK
open ↗
Referência
CVE-2026-79713
CVE-2026-79713MEDIUM
Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
33RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component SimpleShop 3.4 - SQL Injection
CVE-2008-2568—webappsphp
SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remo
23RISK
open ↗
Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) Remote Stack Overflow (PoC)
CVE-2008-2573—doswindows
Stack-based buffer overflow in SFTP in freeSSHd 1.2.1 allows remote authenticated users to execute arbitrary code via a
23RISK
open ↗
Referência
CVE-2018-12465
CVE-2018-12465CRITICAL
Remote Code Execution in Micro Focus Secure Messaging Gateway
85RISK
open ↗
Referência✓ VexDay Proof
Roundcube Webmail 0.2b - Remote Code Execution
CVE-2008-5619—webappsphp
html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail)
35RISK
open ↗
Referência
CVE-2018-20485
CVE-2018-20485—
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
23RISK
open ↗
Referência✓ VexDay Proof
phpMyAdmin 3.1.0 - Cross-Site Request Forgery / SQL Injection
CVE-2008-5621—webappsphp
Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remot
23RISK
open ↗
Referência
CVE-2026-120503
CVE-2026-120503MEDIUM
EchoHS GeekezBrowser Public API status information disclosure
33RISK
open ↗
Referência
CVE-2026-29508
CVE-2026-29508HIGH
ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
41RISK
open ↗
Referência
CVE-2018-13108
CVE-2018-13108—
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure
CVE-2008-5752—webappsphp
Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress
23RISK
open ↗
Referência
CVE-2008-5753
CVE-2008-5753—
Stack-based buffer overflow in BulletProof FTP Client 2.63 and 2010 allows user-assisted attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2021-24276
CVE-2021-24276—
Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)
43RISK
open ↗
Referência
CVE-2026-119731
CVE-2026-119731HIGH
Munshi Payment Bypass via Unauthenticated Webhook Endpoint
41RISK
open ↗
Referência
CVE-2026-120448
CVE-2026-120448HIGH
DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
41RISK
open ↗
Referência
CVE-2021-24272
CVE-2021-24272—
Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)
23RISK
open ↗
Referência✓ VexDay Proof
eFiction 3.0 - 'toplists.php' SQL Injection
CVE-2008-2754—webappsphp
SQL injection vulnerability in toplists.php in eFiction 3.0 and 3.4.3, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência
CVE-2026-107323
CVE-2026-107323MEDIUM
Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
33RISK
open ↗
Referência
CVE-2026-107321
CVE-2026-107321MEDIUM
W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import
33RISK
open ↗
Referência
CVE-2026-120447
CVE-2026-120447CRITICAL
HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
48RISK
open ↗
← previouspage 556 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.