Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,426 exploits

Referência

CVE-2025-59287

CVE-2025-59287CRITICALunder attack

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

100RISK

open ↗

Referência

CVE-2026-12222

CVE-2026-12222HIGH

Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow

41RISK

open ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - SQL Injection

CVE-2008-6788—webappsphp

SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência

CVE-2013-2068

CVE-2013-2068—

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow re

50RISK

open ↗

Referência

CVE-2009-3053

CVE-2009-3053—

Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to inclu

38RISK

open ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin

CVE-2008-6789—webappsphp

SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2009-3054

CVE-2009-3054—

SQL injection vulnerability in the Artetics.com Art Portal (com_artportal) component 1.0 for Joomla! allows remote attac

23RISK

open ↗

Referência

CVE-2014-9348

CVE-2014-9348—

SQL injection vulnerability in the formulaireRobot function in admin/robots.lib.php in RobotStats 1.0 allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow

CVE-2008-3360—remotewindows

Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência✓ VexDay Proof

Invision Power Board 2.0.3 - 'login.php' SQL Injection

CVE-2005-1598—webappsphp

SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary

28RISK

open ↗

Referência

CVE-2014-9349

CVE-2014-9349—

Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Lycos FileUploader Control - ActiveX Remote Buffer Overflow

CVE-2008-0443—remotewindows

Heap-based buffer overflow in the FileUploader.FUploadCtl.1 ActiveX control in FileUploader.dll 2.0.0.2 in Lycos FileUpl

28RISK

open ↗

Referência✓ VexDay Proof

IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow

CVE-2008-3360—remotewindows

Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Ice Gallery 0.5b2 - 'catid' Blind SQL Injection

CVE-2008-6852—webappsphp

SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

CMS NetCat 3.0/3.12 - Blind SQL Injection

CVE-2008-6853—webappsphp

SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Absolute FAQ Manager 6.0 - Insecure Cookie Handling

CVE-2008-6854—webappsphp

Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative acc

23RISK

open ↗

Referência✓ VexDay Proof

Absolute News Feed 1.0 - Remote Insecure Cookie Handling

CVE-2008-6855—webappsphp

Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain adminis

23RISK

open ↗

Referência✓ VexDay Proof

Absolute Content Rotator 6.0 - Insecure Cookie Handling

CVE-2008-6862—webappsphp

Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting

23RISK

open ↗

Referência

CVE-2013-2586

CVE-2013-2586—

XAMPP 1.8.1 does not properly restrict access to xampp/lang.php, which allows remote attackers to modify xampp/lang.tmp

23RISK

open ↗

Referência

CVE-2014-9142

CVE-2014-9142—

Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t

23RISK

open ↗

Referência

CVE-2009-3180

CVE-2009-3180—

Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user param

23RISK

open ↗

Referência

CVE-2014-9144

CVE-2014-9144—

Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metac

23RISK

open ↗

Referência

CVE-2026-9434

CVE-2026-9434CRITICAL

Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection

48RISK

open ↗

Referência

CVE-2013-7186

CVE-2013-7186—

Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long

28RISK

open ↗

Referência

CVE-2022-41040

CVE-2022-41040HIGHunder attackransomware

Microsoft Exchange Server Elevation of Privilege Vulnerability

100RISK

open ↗

Referência

CVE-2026-9431

CVE-2026-9431HIGH

Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow

41RISK

open ↗

Referência

CVE-2013-7186

CVE-2013-7186—

Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long

28RISK

open ↗

Referência

CVE-2013-7186

CVE-2013-7186—

Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long

28RISK

open ↗

Referência

CVE-2014-9418

CVE-2014-9418—

The eSpace Meeting ActiveX control (eSpaceStatusCtrl.dll) in Huawei eSpace Desktop before V200R001C03 allows local users

23RISK

open ↗

Referência

CVE-2014-9611

CVE-2014-9611—

Netsweeper before 4.0.5 allows remote attackers to bypass authentication and create arbitrary accounts and policies via

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.