Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,331cataloged exploits
40,631CVEs with public exploitation
24,696lab-tested
AllReferência 26,377Exploit-DB 24,489GitHub PoC 18,131VulnCheck XDB 10,218Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (1)
CVE-2007-3039—remotewindows
Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Window
50RISK
open ↗
Referência
CVE-2026-108376
CVE-2026-108376HIGH
dataclasses-avroschema allows code injection through record names in generated default factories
41RISK
open ↗
Referência
CVE-2009-2439
CVE-2009-2439—
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2010-3187
CVE-2010-3187—
Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST com
28RISK
open ↗
Referência
CVE-2010-3187
CVE-2010-3187—
Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST com
28RISK
open ↗
Referência
CVE-2026-110113
CVE-2026-110113MEDIUM
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
33RISK
open ↗
Referência
CVE-2022-30286
CVE-2022-30286—
pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.
28RISK
open ↗
Referência
CVE-2016-6175
CVE-2016-6175—
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via
28RISK
open ↗
Referência
CVE-2018-7264
CVE-2018-7264—
The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out
28RISK
open ↗
Referência
CVE-2017-8871
CVE-2017-8871—
The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial o
28RISK
open ↗
Referência
CVE-2020-28337
CVE-2020-28337—
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to g
28RISK
open ↗
Referência
CVE-2022-45297
CVE-2022-45297CRITICAL
EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.
48RISK
open ↗
Referência
CVE-2026-109605
CVE-2026-109605MEDIUM
SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
33RISK
open ↗
Referência
CVE-2009-4058
CVE-2009-4058—
SQL injection vulnerability in allauctions.php in Telebid Auction Script allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2009-4551
CVE-2009-4551—
SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Surgemail 39e-1 - (Authenticated) IMAP Remote Buffer Overflow (Denial of Service) (PoC)
CVE-2008-7182—doswindows
Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote au
28RISK
open ↗
Referência
CVE-2010-1952
CVE-2010-1952—
Directory traversal vulnerability in the BeeHeard (com_beeheard) and BeeHeard Lite (com_beeheardlite) component 1.0 for
43RISK
open ↗
Referência
CVE-2009-3308
CVE-2009-3308—
SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2014-3805
CVE-2014-3805—
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a
28RISK
open ↗
Referência
CVE-2009-3534
CVE-2009-3534—
Directory traversal vulnerability in index.php in LionWiki 3.0.3, when magic_quotes_gpc is disabled, allows remote attac
23RISK
open ↗
Referência
CVE-2019-1322
CVE-2019-1322HIGHunder attackransomware
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft W
91RISK
open ↗
Referência
CVE-2018-15139
CVE-2018-15139—
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote
28RISK
open ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência
CVE-2019-19208
CVE-2019-19208—
Codiad Web IDE through 2.8.4 allows PHP Code injection.
28RISK
open ↗
Referência
CVE-2026-16301
CVE-2026-16301HIGH
Incorrect Authorization in GitLab
41RISK
open ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência
CVE-2016-3116
CVE-2016-3116—
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-c
28RISK
open ↗
Referência
CVE-2026-78335
CVE-2026-78335MEDIUM
Incorrect Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-84906
CVE-2026-84906MEDIUM
Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
33RISK
open ↗
Referência
CVE-2025-9501
CVE-2025-9501CRITICAL
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
53RISK
open ↗
← previouspage 603 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.