Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência✓ VexDay Proof
A Better Member-Based ASP Photo Gallery - 'entry' SQL Injection
SQL injection vulnerability in gallery/view.asp in A Better Member-Based ASP Photo Gallery before 1.2 allows remote atta
23RISK
open ↗Referência
CVE-2010-4984
SQL injection vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
MyShoutPro 1.2 - Final Insecure Cookie Handling
MyShoutPro 1.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin_acce
23RISK
open ↗Referência✓ VexDay Proof
PHP infoBoard 7 - Plus Insecure Cookie Handling
PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the in
23RISK
open ↗Referência
CVE-2016-1593
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remot
50RISK
open ↗Referência
CVE-2017-11861
Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker t
35RISK
open ↗Referência
CVE-2018-8735
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RISK
open ↗Referência
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via l
98RISK
open ↗Referência
CVE-2018-8735
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RISK
open ↗Referência
CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key g
75RISK
open ↗Referência
CVE-2023-34039
Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key g
75RISK
open ↗Referência
CVE-2026-7060
liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection
33RISK
open ↗Referência✓ VexDay Proof
P2P Foxy - Out of Memory Denial of Service
Foxy P2P software allows remote attackers to cause a denial of service (memory consumption) via a foxy URI with a downlo
23RISK
open ↗Referência
CVE-2026-108699
hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
41RISK
open ↗Referência✓ VexDay Proof
SailPlanner 0.3a - Authentication Bypass
Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
w3blabor CMS 3.3.0 - Authentication Bypass
SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disa
23RISK
open ↗Referência
CVE-2009-3175
Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script)
23RISK
open ↗Referência
CVE-2010-5004
SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to exe
23RISK
open ↗Referência
CVE-2010-5009
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2010-5010
Cross-site scripting (XSS) vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers t
23RISK
open ↗Referência
CVE-2018-9948
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader
50RISK
open ↗Referência
CVE-2006-6199
Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote at
50RISK
open ↗Referência
CVE-2017-11165
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a d
50RISK
open ↗Referência
CVE-2019-14287
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
35RISK
open ↗Referência✓ VexDay Proof
Atomic Photo Album 1.1.0pre4 - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to i
23RISK
open ↗Referência✓ VexDay Proof
pNews 2.03 - 'newsid' SQL Injection
SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2018-19459
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
23RISK
open ↗Referência✓ VexDay Proof
RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling
RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verifi
23RISK
open ↗Referência
CVE-2026-108722
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
28RISK
open ↗Referência
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.