Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,426 exploits

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2161—webappsphp

Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-inse

23RISK

open ↗

Referência

CVE-2015-6655

CVE-2015-6655—

Cross-site request forgery (CSRF) vulnerability in Pligg CMS 2.0.2 allows remote attackers to hijack the authentication

23RISK

open ↗

Referência

CVE-2017-1000371

CVE-2017-1000371—

The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1

23RISK

open ↗

Referência

CVE-2009-4466

CVE-2009-4466—

DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which rev

23RISK

open ↗

Referência

CVE-2010-1741

CVE-2010-1741—

SQL injection vulnerability in request_account.php in Billwerx RC 5.2.2 PL2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2009-4472

CVE-2009-4472—

Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2015-3897

CVE-2015-3897—

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via

43RISK

open ↗

Referência

CVE-2019-10847

CVE-2019-10847—

Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.

23RISK

open ↗

Referência

CVE-2026-5316

CVE-2026-5316MEDIUM

Nothings stb stb_vorbis.c setup_free allocation of resources

33RISK

open ↗

Referência

CVE-2017-16807

CVE-2017-16807—

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist

23RISK

open ↗

Referência✓ VexDay Proof

GGCMS 1.1.0 RC1 - Remote Code Execution

CVE-2007-0804—webappsphp

Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2010-3437

CVE-2010-3437—

Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2

23RISK

open ↗

Referência✓ VexDay Proof

Corel Paint Shop Pro Photo 11.20 - '.clp' Local Buffer Overflow

CVE-2007-2209—localwindows

Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear, as used in Corel Paint Shop Pro Photo 11.

28RISK

open ↗

Referência

CVE-2010-4980

CVE-2010-4980—

SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Garennes 0.6.1 - 'repertoire_config' Remote File Inclusion

CVE-2007-2298—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2009-4106

CVE-2009-4106—

Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers

23RISK

open ↗

Referência

CVE-2009-4674

CVE-2009-4674—

admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to cha

23RISK

open ↗

Referência

CVE-2009-2558

CVE-2009-2558—

system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news

23RISK

open ↗

Referência

CVE-2010-4980

CVE-2010-4980—

SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2012-5912

CVE-2012-5912—

Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2012-5912

CVE-2012-5912—

Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions

CVE-2007-5786—webappsphp

Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code

23RISK

open ↗

Referência✓ VexDay Proof

Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation

CVE-2008-2936—locallinux

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system suppor

23RISK

open ↗

Referência✓ VexDay Proof

iyzi Forum 1.0b3 - Database Disclosure

CVE-2008-5901—webappsphp

iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

AvailScript Article Script - 'view.php' SQL Injection

CVE-2008-6037—webappsphp

SQL injection vulnerability in view.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2013-1306

CVE-2013-1306—

Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a cr

35RISK

open ↗

Referência

CVE-2019-18859

CVE-2019-18859—

Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.

23RISK

open ↗

Referência

CVE-2021-40577

CVE-2021-40577—

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP an

23RISK

open ↗

Referência

CVE-2026-89264

CVE-2026-89264MEDIUM

MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

33RISK

open ↗

Referência

CVE-2026-87719

CVE-2026-87719CRITICAL

Deserialization of Untrusted Data in GitLab

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.