Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência✓ VexDay Proof
Online Fantasy Football League (OFFL) 0.2.6 - Remote File Inclusion
CVE-2007-4809—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 allow remote attackers
35RISK
open ↗
Referência✓ VexDay Proof
Online Media Technologies 'AVSMJPEGFILE.DLL 1.1' - Remote Buffer Overflow (PoC)
CVE-2007-6327—doswindows
Buffer overflow in a certain ActiveX control in Online Media Technologies AVSMJPEGFILE.DLL 1.1.1.102 allows remote attac
28RISK
open ↗
Referência✓ VexDay Proof
CPCommerce 1.1.0 - Cross-Site Scripting / Local File Inclusion
CVE-2008-1906—webappsphp
Cross-site scripting (XSS) vulnerability in calendar.php in cpCommerce 1.1.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Psi Jabber Client (Windows / Linux) - Remote Denial of Service
CVE-2008-6393—dosmultiple
PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitr
28RISK
open ↗
Referência✓ VexDay Proof
Explay CMS 2.1 - Insecure Cookie Handling
CVE-2008-6411—webappsphp
Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting th
23RISK
open ↗
Referência✓ VexDay Proof
Social Site Generator 2.0 - Multiple Remote File Disclosure Vulnerabilities
CVE-2008-6420—webappsphp
Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.
23RISK
open ↗
Referência
CVE-2014-6287
CVE-2014-6287CRITICALunder attack
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência
CVE-2014-6332
CVE-2014-6332HIGHunder attack
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MyAlbum 1.0 - 'album' SQL Injection
CVE-2008-6489—webappsphp
SQL injection vulnerability in MyAlbum component (com_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2026-18645
CVE-2026-18645MEDIUM
danpros HTMLy Admin Content Endpoint admin.php add_content path traversal
33RISK
open ↗
Referência
CVE-2026-18644
CVE-2026-18644MEDIUM
danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal
33RISK
open ↗
Referência✓ VexDay Proof
Easy News Content Management - Database Disclosure
CVE-2008-6493—webappsasp
Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗
Referência
CVE-2009-2653
CVE-2009-2653—
The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows
23RISK
open ↗
Referência
CVE-2026-16273
CVE-2026-16273MEDIUM
Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta
33RISK
open ↗
Referência✓ VexDay Proof
FSFDT v3.000 d9 - 'HELP' Remote Buffer Overflow
CVE-2007-5256—remotewindows
Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote
23RISK
open ↗
Referência
CVE-2026-18615
CVE-2026-18615CRITICAL
GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
48RISK
open ↗
Referência
CVE-2023-46805
CVE-2023-46805HIGHunder attackransomware
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re
100RISK
open ↗
Referência
CVE-2023-22527
CVE-2023-22527CRITICALunder attackransomware
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta
100RISK
open ↗
Referência
CVE-2026-10062
CVE-2026-10062HIGH
TRENDnet TEW-432BRP formSetRoute stack-based overflow
41RISK
open ↗
Referência
CVE-2014-6409
CVE-2014-6409—
Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authe
23RISK
open ↗
Referência✓ VexDay Proof
PHP Site Lock 2.0 - 'index.php' SQL Injection
CVE-2008-2865—webappsphp
SQL injection vulnerability in index.php in Kalptaru Infotech PHP Site Lock 2.0 allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Destar 0.2.2-5 - Arbitrary Add Admin
CVE-2008-6539—webappsphp
Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitra
23RISK
open ↗
Referência
CVE-2014-8322
CVE-2014-8322—
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attac
28RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16014
CVE-2026-16014MEDIUM
code-projects Hospital Bed Management System Login Form sql injection
33RISK
open ↗
Referência
Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass
CVE-2021-44655—webappsphp
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. A
23RISK
open ↗
Referência
CVE-2026-84896
CVE-2026-84896MEDIUM
King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
33RISK
open ↗
Referência
CVE-2026-84745
CVE-2026-84745LOW
The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
28RISK
open ↗
← previouspage 712 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.