Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência
CVE-2011-0507
CVE-2011-0507—
FTPService.exe in Blackmoon FTP 3.1 Build 1735 and Build 1736 (3.1.7.1736), and possibly other versions before 3.1.8.173
23RISK
open ↗
Referência✓ VexDay Proof
Imageview 5.3 - 'fileview.php?album' Local File Inclusion
CVE-2007-2425—webappsphp
Directory traversal vulnerability in fileview.php in Imageview 5.3 allows remote attackers to read arbitrary files via a
23RISK
open ↗
Referência✓ VexDay Proof
Demo4 CMS - 'id' SQL Injection
CVE-2008-2983—webappsphp
SQL injection vulnerability in index.php in Demo4 CMS 01 Beta allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Multiple SQL Injections
CVE-2008-3129—webappsphp
Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-2845
CVE-2010-2845—
SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2014-2559
CVE-2014-2559—
Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPre
23RISK
open ↗
Referência
CVE-2018-5315
CVE-2018-5315—
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
23RISK
open ↗
Referência
CVE-2018-5315
CVE-2018-5315—
The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.
23RISK
open ↗
Referência
CVE-2021-47964
CVE-2021-47964HIGH
Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager
41RISK
open ↗
Referência
CVE-2014-9412
CVE-2014-9412—
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
23RISK
open ↗
Referência
CVE-2015-3314
CVE-2015-3314—
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
23RISK
open ↗
Referência
CVE-2021-42325
CVE-2021-42325—
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
28RISK
open ↗
Referência
CVE-2026-87907
CVE-2026-87907MEDIUM
Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
33RISK
open ↗
Referência
CVE-2016-1247
CVE-2016-1247—
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS
23RISK
open ↗
Referência
CVE-2017-8490
CVE-2017-8490—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência✓ VexDay Proof
Foxmail 5.0 - 'PunyLib.dll' Remote Stack Overflow
CVE-2004-2719—remotewindows
Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2026-85349
CVE-2026-85349MEDIUM
FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
Plan 9 Kernel - 'devenv.c OTRUNC/pwrite' Local Privilege Escalation
CVE-2007-1189—localplan9
Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite
23RISK
open ↗
Referência
CVE-2012-3414
CVE-2012-3414—
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before
23RISK
open ↗
Referência
CVE-2026-13330
CVE-2026-13330MEDIUM
Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload
33RISK
open ↗
Referência
CVE-2010-3153
CVE-2010-3153—
Untrusted search path vulnerability in Adobe InDesign CS4 6.0, InDesign CS5 7.0.2 and earlier, Adobe InDesign Server CS5
28RISK
open ↗
Referência
CVE-2013-4092
CVE-2013-4092—
The SecureSphere Operations Manager (SOM) Management Server in Imperva SecureSphere 9.0.0.5 allows context-dependent att
23RISK
open ↗
Referência✓ VexDay Proof
ViRC 2.0 - JOIN Response Remote Overwrite (SEH)
CVE-2007-3612—remotewindows
Stack-based buffer overflow in Visual IRC (ViRC) 2.0 allows remote IRC servers to execute arbitrary code via a long resp
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component beamospetition - SQL Injection
CVE-2008-3132—webappsphp
SQL injection vulnerability in the beamospetition (com_beamospetition) component for Joomla! allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
FlexCMS 2.5 - 'catId' SQL Injection
CVE-2009-0534—webappsphp
SQL injection vulnerability in FlexCMS allows remote attackers to execute arbitrary SQL commands via the catId parameter
23RISK
open ↗
Referência
CVE-2010-1296
CVE-2010-1296—
Multiple buffer overflows in Adobe Photoshop CS4 before 11.0.2 allow user-assisted remote attackers to execute arbitrary
28RISK
open ↗
Referência
CVE-2016-1247
CVE-2016-1247—
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS
23RISK
open ↗
Referência
CVE-2026-91848
CVE-2026-91848MEDIUM
WuzhiCMS index.php getDataOfJson sql injection
33RISK
open ↗
Referência
CVE-2018-20326
CVE-2018-20326—
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage
23RISK
open ↗
Referência
CVE-2024-6460
CVE-2024-6460CRITICAL
Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI
63RISK
open ↗
← previouspage 683 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.