Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,573 exploits
Referência
CVE-2026-25559
CVE-2026-25559HIGH
OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint
41RISK
open ↗
Referência
CVE-2026-25855
CVE-2026-25855HIGH
OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload
41RISK
open ↗
Referência
CVE-2026-11534
CVE-2026-11534MEDIUM
imvks786 student_management_system add.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Quicksilver Forums 1.4.2 (Windows) - Remote Code Execution
CVE-2008-7064—webappsphp
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as use
23RISK
open ↗
Referência✓ VexDay Proof
chipmunk topsites - Authentication Bypass / Cross-Site Scripting
CVE-2008-7071—webappsphp
SQL injection vulnerability in authenticate.php in Chipmunk Topsites allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2011-1249
CVE-2011-1249—
The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis
23RISK
open ↗
Referência
CVE-2024-0723
CVE-2024-0723MEDIUM
freeSSHd denial of service
33RISK
open ↗
Referência
Ingress-NGINX Admission Controller v1.11.1 - FD Injection to RCE
CVE-2025-1974CRITICALremotemultiple
ingress-nginx admission controller RCE escalation
85RISK
open ↗
Referência
CVE-2009-4583
CVE-2009-4583—
SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2009-4583
CVE-2009-4583—
SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2012-6608
CVE-2012-6608—
Cross-site scripting (XSS) vulnerability in xmlservices/E_book.php in Elastix 2.3.0 allows remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2013-0657
CVE-2013-0657—
Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote
28RISK
open ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
Mozilla Firefox 3.0.5 - Status Bar Obfuscation / Clickjacking
CVE-2009-0253—remotewindows
Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that
23RISK
open ↗
Referência
CVE-2009-4604
CVE-2009-4604—
PHP remote file inclusion vulnerability in mamboleto.php in the Fernando Soares Mamboleto (com_mamboleto) component 2.0
23RISK
open ↗
Referência
CVE-2009-4604
CVE-2009-4604—
PHP remote file inclusion vulnerability in mamboleto.php in the Fernando Soares Mamboleto (com_mamboleto) component 2.0
23RISK
open ↗
Referência
CVE-2023-32315
CVE-2023-32315HIGHunder attack
Openfire administration console authentication bypass
100RISK
open ↗
Referência
CVE-2024-3273
CVE-2024-3273HIGHunder attack
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
100RISK
open ↗
Referência
CVE-2014-6389
CVE-2014-6389—
backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharact
23RISK
open ↗
Referência
CVE-2022-22954
CVE-2022-22954CRITICALunder attackransomware
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
100RISK
open ↗
Referência
CVE-2011-2523
CVE-2011-2523—
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗
Referência★ 64
FortiWeb CVE-2025-25257 exploit
CVE-2025-25257CRITICALunder attack
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
Referência
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
CVE-2025-25257CRITICALunder attackwebappsmultiple
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
Referência✓ VexDay Proof
Multiple Vendor - PF Null Pointer Dereference
CVE-2009-0687—dosbsd
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirO
23RISK
open ↗
Referência✓ VexDay Proof
OpenBSD 4.5 - IP datagrams Remote Denial of Service
CVE-2009-0687—dosopenbsd
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirO
23RISK
open ↗
Referência
CVE-2026-8214
CVE-2026-8214MEDIUM
Industrial Application Software IAS Canias ERP RMI doAction improper authentication
33RISK
open ↗
Referência
CVE-2013-2294
CVE-2013-2294—
Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbi
23RISK
open ↗
Referência
CVE-2013-2423
CVE-2013-2423LOWunder attack
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
95RISK
open ↗
Referência
CVE-2009-4721
CVE-2009-4721—
Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web (A-W) BannerAd 1.0 allow remote attackers to ex
23RISK
open ↗
Referência
CVE-2015-0313
CVE-2015-0313HIGHunder attack
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
100RISK
open ↗
← previouspage 604 / 753next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.