Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência✓ VexDay Proof
PHPWebThings 1.4 - 'msg'/'forum' SQL Injection
CVE-2005-4218—webappsphp
SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2022-30333
CVE-2022-30333CRITICALunder attackransomware
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
100RISK
open ↗
Referência
CVE-2026-93975
CVE-2026-93975MEDIUM
code-projects Assessment Management User Editing edit-user.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Rama CMS 0.68 - Cookie: lang Local File Inclusion
CVE-2006-5894—webappsphp
Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows rem
23RISK
open ↗
Referência
CVE-2026-12375
CVE-2026-12375CRITICAL
Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência
CVE-2026-82842
CVE-2026-82842HIGH
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
41RISK
open ↗
Referência
CVE-2026-76003
CVE-2026-76003CRITICAL
UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
48RISK
open ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2873—webappsphp
sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allo
23RISK
open ↗
Referência
CVE-2026-15105
CVE-2026-15105MEDIUM
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write
33RISK
open ↗
Referência
CVE-2026-12277
CVE-2026-12277HIGH
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal
41RISK
open ↗
Referência
CVE-2012-3816
CVE-2012-3816—
WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Requ
23RISK
open ↗
Referência
CVE-2014-8393
CVE-2014-8393—
DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel
23RISK
open ↗
Referência
CVE-2018-15473
CVE-2018-15473MEDIUM
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗
Referência
CVE-2026-14760
CVE-2026-14760MEDIUM
radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free
33RISK
open ↗
Referência
CVE-2023-27100
CVE-2023-27100CRITICAL
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22
48RISK
open ↗
Referência
CVE-2026-14759
CVE-2026-14759MEDIUM
radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow
33RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke NukeAI Module 3b - 'util.php' Remote File Inclusion
CVE-2006-6202—webappsphp
PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Pro
23RISK
open ↗
Referência
CVE-2026-108819
CVE-2026-108819MEDIUM
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
33RISK
open ↗
Referência✓ VexDay Proof
S9Y Serendipity 1.0.3 - 'comment.php' Local File Inclusion
CVE-2006-6242—webappsphp
Multiple directory traversal vulnerabilities in Serendipity 1.0.3 and earlier allow remote attackers to read or include
23RISK
open ↗
Referência✓ VexDay Proof
HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
CVE-2008-2982—webappsphp
Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when register_globals is enabled, allow remote a
23RISK
open ↗
Referência
CVE-2012-3152
CVE-2012-3152CRITICALunder attack
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and
100RISK
open ↗
Referência✓ VexDay Proof
Bea Weblogic Apache Connector - Code Execution / Denial of Service
CVE-2008-3257—remotewindows
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10
60RISK
open ↗
Referência✓ VexDay Proof
Miniweb 2.0 - Authentication Bypass
CVE-2008-6582—webappsphp
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
2WIRE DSL Router - 'xslt' Denial of Service
CVE-2008-6605—doshardware
Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 17
23RISK
open ↗
Referência
CVE-2026-14689
CVE-2026-14689MEDIUM
CodeAstro Apartment Visitor Management System add-apartment.php sql injection
33RISK
open ↗
Referência
CVE-2026-14688
CVE-2026-14688MEDIUM
itsourcecode Online Hotel Management System login.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH
CVE-2008-3280—remotelinux
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Deb
23RISK
open ↗
Referência
CVE-2026-89299
CVE-2026-89299HIGH
WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
41RISK
open ↗
Referência
CVE-2026-89213
CVE-2026-89213HIGH
Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
41RISK
open ↗
Referência✓ VexDay Proof
Phorum 3.2.11 - 'common.php' Remote File Inclusion
CVE-2006-6550—webappsphp
PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute ar
23RISK
open ↗
← previouspage 710 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.