Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência✓ VexDay Proof

PacPoll 4.0 - Database Disclosure

CVE-2008-5981—webappsphp

PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attack

23RISK

open ↗

Referência

CVE-2026-5316

CVE-2026-5316MEDIUM

Nothings stb stb_vorbis.c setup_free allocation of resources

33RISK

open ↗

Referência

CVE-2015-3897

CVE-2015-3897—

Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via

43RISK

open ↗

Referência✓ VexDay Proof

GGCMS 1.1.0 RC1 - Remote Code Execution

CVE-2007-0804—webappsphp

Directory traversal vulnerability in admin/subpages.php in GGCMS 1.1.0 RC1 and earlier allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2017-16807

CVE-2017-16807—

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist

23RISK

open ↗

Referência

CVE-2019-10847

CVE-2019-10847—

Computrols CBAS 18.0.0 allows Cross-Site Request Forgery.

23RISK

open ↗

Referência

CVE-2009-2558

CVE-2009-2558—

system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news

23RISK

open ↗

Referência✓ VexDay Proof

Corel Paint Shop Pro Photo 11.20 - '.clp' Local Buffer Overflow

CVE-2007-2209—localwindows

Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear, as used in Corel Paint Shop Pro Photo 11.

28RISK

open ↗

Referência

CVE-2009-4106

CVE-2009-4106—

Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Garennes 0.6.1 - 'repertoire_config' Remote File Inclusion

CVE-2007-2298—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Garennes 0.6.1 and earlier allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2010-4980

CVE-2010-4980—

SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions

CVE-2007-5786—webappsphp

Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code

23RISK

open ↗

Referência

CVE-2009-4674

CVE-2009-4674—

admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to cha

23RISK

open ↗

Referência

CVE-2012-5912

CVE-2012-5912—

Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2010-3437

CVE-2010-3437—

Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2

23RISK

open ↗

Referência✓ VexDay Proof

Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation

CVE-2008-2936—locallinux

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system suppor

23RISK

open ↗

Referência

CVE-2010-4980

CVE-2010-4980—

SQL injection vulnerability in packagedetails.php in iScripts ReserveLogic 1.0 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2012-5912

CVE-2012-5912—

Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

iyzi Forum 1.0b3 - Database Disclosure

CVE-2008-5901—webappsphp

iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

AvailScript Article Script - 'view.php' SQL Injection

CVE-2008-6037—webappsphp

SQL injection vulnerability in view.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2014-9096

CVE-2014-9096—

Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute a

23RISK

open ↗

Referência

CVE-2015-1476

CVE-2015-1476—

Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2015-1476

CVE-2015-1476—

Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2015-2070

CVE-2015-2070—

SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2015-2070

CVE-2015-2070—

SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2015-6923

CVE-2015-6923—

The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary phy

23RISK

open ↗

Referência

CVE-2018-6563

CVE-2018-6563—

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow

23RISK

open ↗

Referência

CVE-2015-7084

CVE-2015-7084—

The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to g

23RISK

open ↗

Referência

CVE-2018-6563

CVE-2018-6563—

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow

23RISK

open ↗

Referência

CVE-2026-81431

CVE-2026-81431HIGH

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.