Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência✓ VexDay Proof
FlexCMS Calendar - 'itemID' Blind SQL Injection
CVE-2009-1256—webappsphp
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId para
23RISK
open ↗
Referência
CVE-2016-5845
CVE-2016-5845—
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to ca
23RISK
open ↗
Referência
CVE-2014-9113
CVE-2014-9113—
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Use
23RISK
open ↗
Referência
CVE-2016-7288
CVE-2016-7288—
The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
45RISK
open ↗
Referência
CVE-2022-32429
CVE-2022-32429—
An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technolog
60RISK
open ↗
Referência
CVE-2026-74916
CVE-2026-74916MEDIUM
WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
33RISK
open ↗
Referência
CVE-2012-1259
CVE-2012-1259—
Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and pos
23RISK
open ↗
Referência
CVE-2026-84110
CVE-2026-84110MEDIUM
Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security
33RISK
open ↗
Referência
CVE-2026-96892
CVE-2026-96892MEDIUM
Edimax BR-6428nC goform websRedirect redirect
33RISK
open ↗
Referência
CVE-2022-35411
CVE-2022-35411—
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header i
35RISK
open ↗
Referência
CVE-2026-15245
CVE-2026-15245MEDIUM
BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
33RISK
open ↗
Referência
CVE-2015-6104
CVE-2015-6104—
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window
35RISK
open ↗
Referência
CVE-2022-35914
CVE-2022-35914CRITICALunder attack
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗
Referência
CVE-2015-6104
CVE-2015-6104—
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window
35RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência✓ VexDay Proof
Kusaba 1.0.4 - Remote Code Execution (1)
CVE-2008-5663—webappsphp
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execut
23RISK
open ↗
Referência
CVE-2026-82589
CVE-2026-82589MEDIUM
Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service
33RISK
open ↗
Referência
CVE-2026-19071
CVE-2026-19071MEDIUM
itsourcecode Hospital Management System viewappointment.php sql injection
33RISK
open ↗
Referência
CVE-2026-19070
CVE-2026-19070MEDIUM
itsourcecode Hospital Management System viewadmin.php sql injection
33RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALunder attackransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Amevents - SQL Injection
CVE-2008-5768—webappsphp
SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t
23RISK
open ↗
Referência
CVE-2026-67617
CVE-2026-67617MEDIUM
Microweber CMS 2.0.20 Stored XSS via tag_names Parameter
33RISK
open ↗
Referência
CVE-2015-0313
CVE-2015-0313HIGHunder attack
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
100RISK
open ↗
Referência
CVE-2015-9098
CVE-2015-9098—
In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Mon
28RISK
open ↗
Referência
CVE-2026-112273
CVE-2026-112273MEDIUM
libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name
33RISK
open ↗
Referência
CVE-2026-113378
CVE-2026-113378MEDIUM
mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection
33RISK
open ↗
← previouspage 686 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.