Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,052cataloged exploits
40,803CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,347VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,377 exploits
Referência
CVE-2012-4267
CVE-2012-4267—
Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2026-76989
CVE-2026-76989MEDIUM
liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-bounds
33RISK
open ↗
Referência
CVE-2026-16950
CVE-2026-16950HIGH
Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products
41RISK
open ↗
Referência
CVE-2026-16617
CVE-2026-16617HIGH
Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
41RISK
open ↗
Referência
CVE-2026-12518
CVE-2026-12518HIGH
Local privilege escalation in the Logi Options+ updater service on Windows
41RISK
open ↗
Referência
CVE-2026-86244
CVE-2026-86244MEDIUM
FastAdmin User Controller User.php login cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
ToursManager - 'tourview.php' Blind SQL Injection
CVE-2008-6303—webappsphp
SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion
CVE-2008-6305—webappsphp
PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions
CVE-2008-6308—webappsphp
Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote
23RISK
open ↗
Referência
CVE-2026-17017
CVE-2026-17017HIGH
CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
41RISK
open ↗
Referência✓ VexDay Proof
Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow
CVE-2007-6387—remotewindows
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Van
35RISK
open ↗
Referência✓ VexDay Proof
Web Calendar 4.1 - Blind SQL Injection
CVE-2008-1954—webappsphp
SQL injection vulnerability in one_day.php in Web Calendar Pro 4.1 and earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2013-0135
CVE-2013-0135—
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
helplink 0.1.0 - 'show.php' Remote File Inclusion
CVE-2007-5099—webappsphp
PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute a
35RISK
open ↗
Referência✓ VexDay Proof
Ask.com/AskJeeves Toolbar Toolbar 4.0.2.53 - ActiveX Remote Buffer Overflow
CVE-2007-5107—remotewindows
Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media
50RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.2 - 'uid' SQL Injection
CVE-2008-6438—webappsphp
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗
Referência✓ VexDay Proof
6rbScript 3.3 - 'section.php' Local File Inclusion
CVE-2008-6453—webappsphp
Directory traversal vulnerability in section.php in 6rbScript 3.3, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
TAGWORX.CMS 3.00.02 - Multiple SQL Injections
CVE-2008-2394—webappsphp
Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Plaincart 1.1.2 - 'p' SQL Injection
CVE-2008-6469—webappsphp
SQL injection vulnerability in index.php in PlainCart 1.1.2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component versioning 1.0.2 - 'id' SQL Injection
CVE-2008-6481—webappsphp
SQL injection vulnerability in the Versioning component (com_versioning) 1.0.2 in Joomla! and Mambo allows remote attack
23RISK
open ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALunder attack
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MyAlbum 1.0 - 'album' SQL Injection
CVE-2008-6489—webappsphp
SQL injection vulnerability in MyAlbum component (com_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2026-18645
CVE-2026-18645MEDIUM
danpros HTMLy Admin Content Endpoint admin.php add_content path traversal
33RISK
open ↗
Referência
CVE-2026-18644
CVE-2026-18644MEDIUM
danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal
33RISK
open ↗
Referência✓ VexDay Proof
Easy News Content Management - Database Disclosure
CVE-2008-6493—webappsasp
Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗
Referência
CVE-2009-2653
CVE-2009-2653—
The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows
23RISK
open ↗
Referência
CVE-2026-16273
CVE-2026-16273MEDIUM
Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta
33RISK
open ↗
Referência✓ VexDay Proof
FSFDT v3.000 d9 - 'HELP' Remote Buffer Overflow
CVE-2007-5256—remotewindows
Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote
23RISK
open ↗
← previouspage 663 / 880next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.