Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,457cataloged exploits
39,903CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,487GitHub PoC 17,209VulnCheck XDB 9,874Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência
CVE-2011-5002
CVE-2011-5002—
Multiple stack-based buffer overflows in Final Draft 8 before 8.02 allow remote attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server - Code Execution (PoC) (MS08-067)
CVE-2008-4250CRITICALunder attackdoswindows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗
Referência
CVE-2022-1609
CVE-2022-1609CRITICAL
The School Management < 9.9.7 - Unauthenticated RCE via REST api
75RISK
open ↗
Referência✓ VexDay Proof
CF_Forum - Blind SQL Injection
CVE-2008-6324—webappsasp
SQL injection vulnerability in forummessages.cfm in CF_Forum allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
LoveCMS 1.6.2 Final (Download Manager 1.0) - Arbitrary File Upload
CVE-2008-7062—webappsphp
Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Mobile 6.0 - Device Long Name Remote Reboot (Denial of Service)
CVE-2008-4295—doshardware
Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to esta
35RISK
open ↗
Referência
CVE-2014-6277
CVE-2014-6277—
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
35RISK
open ↗
Referência✓ VexDay Proof
A Better Member-Based ASP Photo Gallery - 'entry' SQL Injection
CVE-2009-0531—webappsphp
SQL injection vulnerability in gallery/view.asp in A Better Member-Based ASP Photo Gallery before 1.2 allows remote atta
23RISK
open ↗
Referência
CVE-2010-4984
CVE-2010-4984—
SQL injection vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure
CVE-2005-2327—webappsphp
Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência✓ VexDay Proof
SailPlanner 0.3a - Authentication Bypass
CVE-2008-7077—webappsphp
Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2016-1593
CVE-2016-1593—
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remot
50RISK
open ↗
Referência
CVE-2017-11861
CVE-2017-11861—
Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker t
35RISK
open ↗
Referência
CVE-2018-8735
CVE-2018-8735—
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RISK
open ↗
Referência
CVE-2019-8394
CVE-2019-8394HIGHunder attack
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via l
98RISK
open ↗
Referência
CVE-2023-34039
CVE-2023-34039CRITICAL
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key g
75RISK
open ↗
Referência
CVE-2023-34039
CVE-2023-34039CRITICAL
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key g
75RISK
open ↗
Referência
CVE-2026-7060
CVE-2026-7060MEDIUM
liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection
33RISK
open ↗
Referência
CVE-2018-8735
CVE-2018-8735—
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RISK
open ↗
Referência
CVE-2026-108699
CVE-2026-108699HIGH
hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
41RISK
open ↗
Referência✓ VexDay Proof
w3blabor CMS 3.3.0 - Authentication Bypass
CVE-2009-0597—webappsphp
SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disa
23RISK
open ↗
Referência
CVE-2009-3175
CVE-2009-3175—
Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script)
23RISK
open ↗
Referência
CVE-2010-5004
CVE-2010-5004—
SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2010-5009
CVE-2010-5009—
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
PHP infoBoard 7 - Plus Insecure Cookie Handling
CVE-2008-4334—webappsphp
PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the in
23RISK
open ↗
Referência
CVE-2010-5010
CVE-2010-5010—
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers t
23RISK
open ↗
Referência
CVE-2010-5010
CVE-2010-5010—
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers t
23RISK
open ↗
Referência
CVE-2018-9948
CVE-2018-9948—
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader
50RISK
open ↗
Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
CVE-2008-7098—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2018-19459
CVE-2018-19459—
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
23RISK
open ↗
← previouspage 64 / 862next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.