Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,327 exploits

Referência✓ VexDay Proof

Microsoft Windows - '.hlp' Local HEAP Overflow (PoC)

CVE-2007-1912—doswindows

Heap-based buffer overflow in Microsoft Windows allows user-assisted remote attackers to have an unknown impact via a cr

28RISK

open ↗

Referência

CVE-2026-14654

CVE-2026-14654MEDIUM

SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

Beryo 2.0 - 'downloadpic.php?chemin' Remote File Disclosure

CVE-2007-1929—webappsphp

Directory traversal vulnerability in downloadpic.php in Beryo 2.0, and possibly other versions including 2.4, allows rem

23RISK

open ↗

Referência✓ VexDay Proof

PcP-Guestbook 3.0 - 'lang' Local File Inclusion

CVE-2007-1933—webappsphp

Multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 allow remote attackers to include and execu

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Nuke Module eBoard 1.0.7 - GLOBALS[name] Local File Inclusion

CVE-2007-1934—webappsphp

Directory traversal vulnerability in member.php in the eBoard 1.0.7 module for PHP-Nuke allows remote attackers to inclu

23RISK

open ↗

Referência

CVE-2017-11151

CVE-2017-11151—

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers

28RISK

open ↗

Referência

CVE-2017-2930

CVE-2017-2930—

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurre

28RISK

open ↗

Referência

CVE-2017-2930

CVE-2017-2930—

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurre

28RISK

open ↗

Referência

CVE-2018-19864

CVE-2018-19864—

NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a

28RISK

open ↗

Referência

CVE-2022-31854

CVE-2022-31854—

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin

50RISK

open ↗

Referência

CVE-2016-3216

CVE-2016-3216—

GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W

28RISK

open ↗

Referência

CVE-2022-3038

CVE-2022-3038HIGHunder attack

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially explo

76RISK

open ↗

Referência

CVE-2026-110696

CVE-2026-110696MEDIUM

itsmeravitejak Online-Examination-System dbtables.sql information disclosure

33RISK

open ↗

Referência✓ VexDay Proof

PHP DocWriter 0.3 - 'script' Remote File Inclusion

CVE-2006-4912—webappsphp

PHP remote file inclusion vulnerability in PHP DocWriter 0.3 and earlier allows remote attackers to execute arbitrary PH

23RISK

open ↗

Referência

CVE-2017-3061

CVE-2017-3061—

Adobe Flash Player versions 25.0.0.127 and earlier have an exploitable memory corruption vulnerability in the SWF parser

28RISK

open ↗

Referência✓ VexDay Proof

Tekman Portal 1.0 - 'tr' SQL Injection

CVE-2006-4916—webappsasp

SQL injection vulnerability in uye_profil.asp in Tekman Portal (TR) 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

VUPlayer 2.44 - '.m3u' UNC Name Buffer Overflow

CVE-2006-6251—localwindows

Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long st

50RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection

CVE-2007-1974—webappsphp

SQL injection vulnerability in the getArticle function in class/wfsarticle.php in WF-Section (aka WF-Sections) 1.0.1, as

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component zOOm Media Gallery 2.5 Beta 2 - Remote File Inclusion

CVE-2007-1992—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the com_zoom 2.5 beta 2 and earlier module for Mambo allow remote

23RISK

open ↗

Referência✓ VexDay Proof

Weatimages 1.7.1 - ini[langpack] Remote File Inclusion

CVE-2007-1999—webappsphp

PHP remote file inclusion vulnerability in index.php in Weatimages 1.7.1 and earlier, when weatimages.ini is missing, al

23RISK

open ↗

Referência✓ VexDay Proof

InoutMailingListManager 3.1 - Remote Command Execution

CVE-2007-2002—webappsphp

InoutMailingListManager 3.1 and earlier allows remote attackers to access certain restricted functionality, and upload a

23RISK

open ↗

Referência

CVE-2017-15367

CVE-2017-15367—

Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access

28RISK

open ↗

Referência

CVE-2019-13577

CVE-2019-13577—

SnmpAdm.exe in MAPLE WBT SNMP Administrator v2.0.195.15 has an Unauthenticated Remote Buffer Overflow via a long string

28RISK

open ↗

Referência

CVE-2021-46418

CVE-2021-46418—

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

43RISK

open ↗

Referência

CVE-2009-3336

CVE-2009-3336—

SQL injection vulnerability in auction_details.php in PHP Pro Bid allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2009-4872

CVE-2009-4872—

Multiple SQL injection vulnerabilities in globepersonnel_login.asp in Logoshows BBS 2.0 allow remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

torrentflux 2.2 - Arbitrary File Create/ Execute/Delete

CVE-2006-6330—webappsphp

index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in t

23RISK

open ↗

Referência✓ VexDay Proof

pl-PHP Beta 0.9 - Multiple Vulnerabilities

CVE-2007-2007—webappsphp

admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the is_admin parameter to 1.

23RISK

open ↗

Referência✓ VexDay Proof

openMairie 1.10 - '/scr/soustab.php' Local File Inclusion

CVE-2007-2069—webappsphp

Directory traversal vulnerability in scr/soustab.php in openMairie 1.11 and earlier allows remote attackers to include a

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component OnlineFlashQuiz 1.0.2 - Remote File Inclusion

CVE-2008-1682—webappsphp

PHP remote file inclusion vulnerability in quiz/common/db_config.inc.php in the Online FlashQuiz (com_onlineflashquiz) 1

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.