Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência
CVE-2018-16836
CVE-2018-16836—
Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attac
50RISK
open ↗
Referência
CVE-2023-28502
CVE-2023-28502CRITICAL
Stack buffer overflow in UniRPC's udadmin_server service
75RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Content 1.0.0 - 'itemID' SQL Injection
CVE-2008-6923—webappsphp
SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
DeluxeBB 1.07 - Remote Create Admin
CVE-2006-3304—webappsphp
SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component xstandard editor 1.5.8 - Local Directory Traversal
CVE-2009-0113—webappsphp
Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allo
23RISK
open ↗
Referência
CVE-2010-5323
CVE-2010-5323—
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration M
28RISK
open ↗
Referência
CVE-2015-4133
CVE-2015-4133—
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 f
50RISK
open ↗
Referência
CVE-2015-7602
CVE-2015-7602—
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (d
50RISK
open ↗
Referência
CVE-2018-18982
CVE-2018-18982—
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
50RISK
open ↗
Referência
CVE-2018-7445
CVE-2018-7445CRITICALunder attack
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remot
90RISK
open ↗
Referência
CVE-2026-102911
CVE-2026-102911CRITICAL
zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection
48RISK
open ↗
Referência✓ VexDay Proof
Vastal I-Tech Mag Zone - 'cat_id' SQL Injection
CVE-2008-4464—webappsphp
SQL injection vulnerability in view_mags.php in Vastal I-Tech Mag Zone allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-102507
CVE-2026-102507MEDIUM
Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC
33RISK
open ↗
Referência
CVE-2013-4074
CVE-2013-4074—
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
50RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload
CVE-2008-6944—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi
23RISK
open ↗
Referência
CVE-2014-2849
CVE-2014-2849—
The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users
50RISK
open ↗
Referência
CVE-2014-3913
CVE-2014-3913—
Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrar
50RISK
open ↗
Referência
CVE-2014-3913
CVE-2014-3913—
Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrar
50RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6947—webappsphp
Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via un
23RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6948—webappsphp
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code b
23RISK
open ↗
Referência
CVE-2009-3224
CVE-2009-3224—
SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remo
23RISK
open ↗
Referência
CVE-2017-5941
CVE-2017-5941—
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RISK
open ↗
Referência
CVE-2016-20017
CVE-2016-20017CRITICALunder attack
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as
100RISK
open ↗
Referência
CVE-2013-4074
CVE-2013-4074—
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
50RISK
open ↗
Referência
CVE-2018-3639
CVE-2018-3639MEDIUM
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
45RISK
open ↗
Referência
CVE-2018-8770
CVE-2018-8770—
Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via generate.php, controllers/getConfigTest.php, contro
50RISK
open ↗
Referência✓ VexDay Proof
Yourownbux 4.0 - 'cookie' SQL Injection
CVE-2008-4492—webappsphp
SQL injection vulnerability in referrals.php in YourOwnBux 4.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2014-8657
CVE-2014-8657—
The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r
23RISK
open ↗
Referência
CVE-2025-40553
CVE-2025-40553CRITICAL
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
60RISK
open ↗
Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.5 - Local File Inclusion / Remote File Inclusion / SQL Injection
CVE-2008-6409—webappsphp
SQL injection vulnerability in index.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
← previouspage 71 / 862next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.