Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
25,629 exploits
Referência✓ VexDay Proof
CS-Cart 1.3.3 - 'classes_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in class.cs_phpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute ar
23RISK
open ↗Referência
CVE-2017-8548
Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain
35RISK
open ↗Referência
CVE-2017-9833
/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read
50RISK
open ↗Referência
CVE-2017-14494
dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect
35RISK
open ↗Referência
CVE-2018-12613
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISK
open ↗Referência
CVE-2018-8353
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
35RISK
open ↗Referência
CVE-2018-16858
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could
68RISK
open ↗Referência
CVE-2018-16858
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could
68RISK
open ↗Referência
CVE-2019-9879
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever
50RISK
open ↗Referência
CVE-2009-3056
PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attac
23RISK
open ↗Referência
CVE-2010-4406
Directory traversal vulnerability in gallery.php in Brunetton LittlePhpGallery 1.0.2, when magic_quotes_gpc is disabled,
23RISK
open ↗Referência✓ VexDay Proof
Wikiwig 4.1 - 'wk_lang.php' Remote File Inclusion
PHP remote file inclusion vulnerability in _wk/wk_lang.php in Wikiwig 4.1 and earlier allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Friendly Technologies - Read/Write Registry/Read Files
A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remot
23RISK
open ↗Referência✓ VexDay Proof
D-iscussion Board 3.01 - 'topic' Local File Inclusion
Directory traversal vulnerability in index.php in D-iscussion Board 3.01 allows remote attackers to read arbitrary files
23RISK
open ↗Referência
CVE-2026-109177
MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit
33RISK
open ↗Referência
CVE-2026-13597
QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover
48RISK
open ↗Referência
CVE-2015-0802
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
50RISK
open ↗Referência
CVE-2012-6519
SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2015-7765
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
50RISK
open ↗Referência✓ VexDay Proof
Simple Document Management System 1.1.4 - Authentication Bypass
SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earli
23RISK
open ↗Referência
CVE-2015-7765
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
50RISK
open ↗Referência
CVE-2019-9881
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on
43RISK
open ↗Referência✓ VexDay Proof
Absolute Podcast 1.0 - Remote Insecure Cookie Handling
Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a c
23RISK
open ↗Referência✓ VexDay Proof
Winamp 5.541 - '.mp3'/'.aiff' File Multiple Denial of Service Vulnerabilities
Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly e
28RISK
open ↗Referência
CVE-2009-3058
Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .
23RISK
open ↗Referência✓ VexDay Proof
FunkBoard CF0.71 - 'profile.php' Remote User Pass Change
profile.php in FunkBoard CF0.71 allows remote attackers to change arbitrary passwords via a modified uid hidden form fie
23RISK
open ↗Referência
CVE-2010-4435
Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, a
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.