Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência
CVE-2012-0902
AirTies Air 4450 1.1.2.18 allows remote attackers to cause a denial of service (reboot) via a direct request to cgi-bin/
23RISK
open ↗Referência✓ VexDay Proof
MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject
23RISK
open ↗Referência✓ VexDay Proof
Apple Safari - 'ARGUMENTS' Array Integer Overflow HeapSpray (PoC)
Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations, cau
23RISK
open ↗Referência
CVE-2010-1652
Directory traversal vulnerability in the HelpCenter module in Help Center Live (HCL) 2.0.6 and 2.1.7 allows remote attac
23RISK
open ↗Referência✓ VexDay Proof
blogplus 1.0 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary loc
23RISK
open ↗Referência
CVE-2010-1652
Directory traversal vulnerability in the HelpCenter module in Help Center Live (HCL) 2.0.6 and 2.1.7 allows remote attac
23RISK
open ↗Referência
CVE-2026-19789
Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow
41RISK
open ↗Referência
CVE-2021-21985
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
100RISK
open ↗Referência
CVE-2021-21985
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
100RISK
open ↗Referência
CVE-2024-21887
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,
100RISK
open ↗Referência
CVE-2026-12083
Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter
41RISK
open ↗Referência✓ VexDay Proof
Pictures Rating - 'index.php?msgid' SQL Injection
SQL injection vulnerability in index.php in Pictures Rating (Picture Rating) allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Softbiz Auctions Script - 'product_desc.php' SQL Injection
SQL injection vulnerability in product_desc.php in Softbiz Auctions Script allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
freeSSHd 1.2.1 - (Authenticated) SFTP 'rename' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in freeSSHd 1.2.1 allows remote authenticated users to cause a denial of service (service cr
28RISK
open ↗Referência
CVE-2010-4860
SQL injection vulnerability in product_desc.php in MyPhpAuction 2010 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2026-34110
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php
48RISK
open ↗Referência
CVE-2026-14440
Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records
41RISK
open ↗Referência
CVE-2026-59098
LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search
41RISK
open ↗Referência
CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗Referência
CVE-2010-4954
SQL injection vulnerability in product_reviews_info.php in xt:Commerce Gambio 2008 allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
1024 CMS 0.7 - 'download.php' Remote File Disclosure
Directory traversal vulnerability in includes/download.php in Treble Designs 1024 CMS 0.7 allows remote attackers to rea
23RISK
open ↗Referência✓ VexDay Proof
Maran PHP Shop - 'prod.php' SQL Injection
SQL injection vulnerability in prod.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência✓ VexDay Proof
Maran PHP Shop - 'prodshow.php' SQL Injection
SQL injection vulnerability in prodshow.php in Maran PHP Shop allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
YourFreeWorld Classifieds Hosting - SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Hosting Script allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2014-5083
A Command Execution vulnerability exists in Sphider before 1.3.6 due to insufficient sanitization of fwrite to conf.php,
23RISK
open ↗Referência✓ VexDay Proof
SerWeb 2.0.0 dev1 2007-02-20 - Multiple Local/Remote File Inclusion Vulnerabilities
Multiple directory traversal vulnerabilities in js/get_js.php in SERWeb 2.0.0 dev1 and earlier allow remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
MW6 Aztec - ActiveX 'Aztec.dll' Remote Insecure Method
Multiple insecure method vulnerabilities in MW6 Technologies Aztec ActiveX control (AZTECLib.MW6Aztec, Aztec.dll) 3.0.0.
23RISK
open ↗Referência
CVE-2010-5023
SQL injection vulnerability in index.asp in Digital Interchange Calendar 5.8.5 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
MW6 Datamatrix - ActiveX 'Datamatrix.dll' Insecure Method
Multiple insecure method vulnerabilities in MW6 Technologies DataMatrix ActiveX control (DATAMATRIXLib.MW6DataMatrix, Da
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.