Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência
CVE-2018-9235
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.
23RISK
open ↗Referência
CVE-2024-24724
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
53RISK
open ↗Referência✓ VexDay Proof
Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution
Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple
28RISK
open ↗Referência✓ VexDay Proof
Azucar CMS 1.3 - '/admin/index_sitios.php' File Inclusion
PHP remote file inclusion vulnerability in admin/index_sitios.php in Azucar CMS 1.3 allows remote attackers to execute a
23RISK
open ↗Referência
CVE-2011-1714
Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and pos
23RISK
open ↗Referência
CVE-2011-4337
Static code injection vulnerability in translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows rem
23RISK
open ↗Referência✓ VexDay Proof
FS4104-AW VDSL Device (Rooter) - GoAhead WebServer Disclosure
goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the type
23RISK
open ↗Referência
CVE-2015-3083
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460
35RISK
open ↗Referência✓ VexDay Proof
Maxtrade AIO 1.3.23 - 'categori' SQL Injection
SQL injection vulnerability in the Trade module in Maxtrade AIO 1.3.23 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Arbitrary Add Admin / remove user
useradmin.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 does not require administrative authentication, which allow
23RISK
open ↗Referência✓ VexDay Proof
Cain & Abel 4.9.23 - '.rdp' Buffer Overflow (PoC)
Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier,
50RISK
open ↗Referência✓ VexDay Proof
LoveCMS 1.6.2 Final - Arbitrary File Delete
Directory traversal vulnerability in system/admin/images.php in LoveCMS 1.6.2 Final allows remote attackers to delete ar
23RISK
open ↗Referência✓ VexDay Proof
fhttpd 0.4.2 - 'un64()' Remote Denial of Service
fhttpd 0.4.2 allows remote attackers to cause a denial of service (crash) via an Authorization HTTP header with an inval
23RISK
open ↗Referência
CVE-2010-0804
Cross-site scripting (XSS) vulnerability in index.php in iBoutique 4.0 allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência✓ VexDay Proof
PPLive 1.9.21 - '/LoadModule' URI Handlers Argument Injection
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote atta
23RISK
open ↗Referência
CVE-2009-4874
TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attack
23RISK
open ↗Referência
CVE-2009-4874
TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attack
23RISK
open ↗Referência
CVE-2015-2199
Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote
23RISK
open ↗Referência
CVE-2021-26918
The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send
48RISK
open ↗Referência
CVE-2016-4208
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acro
28RISK
open ↗Referência
CVE-2010-1599
SQL injection vulnerability in loadorder.php in NKInFoWeb 2.5 and 5.2.2.0 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência
CVE-2018-1002006
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact
23RISK
open ↗Referência
Uplay 92.0.0.6280 - Local Privilege Escalation
Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.
23RISK
open ↗Referência
CVE-2026-14305
WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes
33RISK
open ↗Referência
CVE-2012-3351
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers
23RISK
open ↗Referência✓ VexDay Proof
nuseo PHP enterprise 1.6 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when registe
23RISK
open ↗Referência✓ VexDay Proof
PHP Live Helper 2.0.1 - Multiple Vulnerabilities
Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier, when register_globals is
23RISK
open ↗Referência
CVE-2026-34021
Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.