Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,377 exploits
Referência
CVE-2014-8655
CVE-2014-8655—
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
23RISK
open ↗
Referência✓ VexDay Proof
asg-sentry 7.0.0 - Multiple Vulnerabilities
CVE-2008-1322—dosmultiple
The File Check Utility (fcheck.exe) in ASG-Sentry Network Manager 7.0.0 and earlier allows remote attackers to cause a d
23RISK
open ↗
Referência
CVE-2015-4075
CVE-2015-4075—
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted
23RISK
open ↗
Referência
CVE-2015-4075
CVE-2015-4075—
The Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to write to arbitrary .ini files via a crafted
23RISK
open ↗
Referência
CVE-2015-7893
CVE-2015-7893—
SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaS
23RISK
open ↗
Referência
CVE-2026-90715
CVE-2026-90715MEDIUM
marcobambini Gravity udp json-parser gravity_json.c integer overflow
33RISK
open ↗
Referência
CVE-2009-4817
CVE-2009-4817—
Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-90699
CVE-2026-90699CRITICAL
D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection
48RISK
open ↗
Referência
CVE-2026-90698
CVE-2026-90698MEDIUM
memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds
33RISK
open ↗
Referência
CVE-2010-2144
CVE-2010-2144—
Cross-site scripting (XSS) vulnerability in signinform.php in Zeeways eBay Clone Auction Script allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Adobe Album Starter 3.2 - Unchecked Local Buffer Overflow
CVE-2008-1765—localwindows
Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remot
28RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component DBQuery 1.4.1.1 - Remote File Inclusion
CVE-2008-6841—webappsphp
PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_
23RISK
open ↗
Referência
CVE-2009-3325
CVE-2009-3325—
SQL injection vulnerability in the Focusplus Developments Survey Manager (com_surveymanager) component 1.5.0 for Joomla!
23RISK
open ↗
Referência
CVE-2014-4971
CVE-2014-4971—
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISK
open ↗
Referência
CVE-2010-2144
CVE-2010-2144—
Cross-site scripting (XSS) vulnerability in signinform.php in Zeeways eBay Clone Auction Script allows remote attackers
23RISK
open ↗
Referência
CVE-2014-8655
CVE-2014-8655—
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
23RISK
open ↗
Referência
CVE-2013-6040
CVE-2013-6040HIGH
MW6 Aztec, DataMatrix, and MaxiCode ActiveX controls versions before 4.0 are vulnerable to arbitrary code via crafted HTML document.
41RISK
open ↗
Referência
CVE-2017-15879
CVE-2017-15879—
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
23RISK
open ↗
Referência
CVE-2017-7046
CVE-2017-7046—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência
CVE-2026-47094
CVE-2026-47094HIGH
SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}
41RISK
open ↗
Referência
CVE-2018-10255
CVE-2018-10255—
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level pri
23RISK
open ↗
Referência
CVE-2018-12522
CVE-2018-12522—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ pro
23RISK
open ↗
Referência
CVE-2022-40319
CVE-2022-40319HIGH
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a
41RISK
open ↗
Referência
CVE-2026-4357
CVE-2026-4357CRITICAL
Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2026-84833
CVE-2026-84833MEDIUM
ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption
33RISK
open ↗
Referência✓ VexDay Proof
BIND 9.4.1 < 9.4.2 - Remote DNS Cache Poisoning (Metasploit)
CVE-2008-1447—remotemultiple
The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windo
60RISK
open ↗
Referência
CVE-2026-110527
CVE-2026-110527MEDIUM
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass
33RISK
open ↗
Referência
CVE-2026-106470
CVE-2026-106470MEDIUM
WP Data Access < 5.5.88 - Subscriber+ SSRF
33RISK
open ↗
Referência
CVE-2009-4437
CVE-2009-4437—
Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Absolute NewsLetter 6.1 - Insecure Cookie Handling
CVE-2008-6861—webappsphp
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative
23RISK
open ↗
← previouspage 668 / 880next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.