Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência✓ VexDay Proof
ClanLite 2.x - SQL Injection / Cross-Site Scripting
CVE-2008-5215—webappsphp
SQL injection vulnerability in service/profil.php in ClanLite 2.2006.05.20 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-56786
CVE-2026-56786CRITICAL
RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message
48RISK
open ↗
Referência
CVE-2026-90714
CVE-2026-90714MEDIUM
marcobambini Gravity JSON parser gravity_json.c memory corruption
33RISK
open ↗
Referência
CVE-2012-10054
CVE-2012-10054CRITICAL
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
63RISK
open ↗
Referência
CVE-2012-10054
CVE-2012-10054CRITICAL
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
63RISK
open ↗
Referência
CVE-2012-10054
CVE-2012-10054CRITICAL
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
63RISK
open ↗
Referência
CVE-2009-4224
CVE-2009-4224—
Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to exec
23RISK
open ↗
Referência
CVE-2009-2231
CVE-2009-2231—
MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record
23RISK
open ↗
Referência✓ VexDay Proof
registroTL - 'main.php' Remote File Inclusion
CVE-2006-5316—webappsphp
registroTL stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RISK
open ↗
Referência
CVE-2009-4989
CVE-2009-4989—
Cross-site scripting (XSS) vulnerability in index.php in AJ Auction Pro OOPD 3.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2026-13489
CVE-2026-13489LOW
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
28RISK
open ↗
Referência
CVE-2017-16841
CVE-2017-16841—
LanSweeper 6.0.100.75 has XSS via the description parameter to /Calendar/CalendarActions.aspx.
23RISK
open ↗
Referência
CVE-2018-25080
CVE-2018-25080LOW
MobileDetect Example session_example.php initLayoutType cross site scripting
28RISK
open ↗
Referência
CVE-2010-0753
CVE-2010-0753—
SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2013-5317
CVE-2013-5317—
Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2010-1538
CVE-2010-1538—
SQL injection vulnerability in print_raincheck.php in phpRAINCHECK 1.0.1 and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2013-5317
CVE-2013-5317—
Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2014-4162
CVE-2014-4162—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote att
23RISK
open ↗
Referência
CVE-2014-4162
CVE-2014-4162—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote att
23RISK
open ↗
Referência
CVE-2026-56779
CVE-2026-56779MEDIUM
MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
33RISK
open ↗
Referência
CVE-2014-7281
CVE-2014-7281—
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN a
23RISK
open ↗
Referência
CVE-2014-7281
CVE-2014-7281—
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN a
23RISK
open ↗
Referência
CVE-2016-4117
CVE-2016-4117HIGHunder attackransomware
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as
100RISK
open ↗
Referência
CVE-2026-12784
CVE-2026-12784HIGH
IM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control
41RISK
open ↗
Referência
CVE-2026-85513
CVE-2026-85513MEDIUM
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
33RISK
open ↗
Referência✓ VexDay Proof
DodosMail 2.0.1 - 'dodosmail.php' Remote File Inclusion
CVE-2006-5841—webappsphp
Multiple PHP remote file inclusion vulnerabilities in dodosmail.php in DodosMail 2.0.1 and earlier, and possibly 2.1, al
23RISK
open ↗
Referência✓ VexDay Proof
Lms 1.8.9 - Vala Remote File Inclusion
CVE-2007-1643—webappsphp
Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote at
28RISK
open ↗
Referência
CVE-2008-5281
CVE-2008-5281—
Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a lo
38RISK
open ↗
Referência
CVE-2018-15533
CVE-2018-15533—
A reflected cross-site scripting vulnerability exists in Geutebrueck re_porter 16 before 7.8.974.20 by appending a query
23RISK
open ↗
Referência
CVE-2018-5986
CVE-2018-5986—
SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.
23RISK
open ↗
← previouspage 725 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.