Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência✓ VexDay Proof
Joovili 3.0 - Multiple SQL Injections
SQL injection vulnerability in Joovili 3.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
The Gemini Portal 4.7 - 'lang' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in The Gemini Portal 4.7 allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
ReVou Twitter Clone - Authentication Bypass
Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
k-rate - SQL Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate Premium allow remote attackers to inject arbitrary w
23RISK
open ↗Referência✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attack
23RISK
open ↗Referência
CVE-2016-0784
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1
35RISK
open ↗Referência
CVE-2017-6019
An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830
35RISK
open ↗Referência
CVE-2015-0313
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
100RISK
open ↗Referência★ 19
watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vul
75RISK
open ↗Referência
CVE-2015-3080
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows
35RISK
open ↗Referência
CVE-2026-111144
libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin
33RISK
open ↗Referência
CVE-2026-111143
Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding
33RISK
open ↗Referência✓ VexDay Proof
KVIrc 3.4.0 - Virgo Remote Format String (PoC)
Format string vulnerability in the URI handler in KVirc 3.4.0, when set as the default application for processing IRC UR
23RISK
open ↗Referência✓ VexDay Proof
Facil-CMS 0.1RC - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a ..
23RISK
open ↗Referência
CVE-2011-1048
SQL injection vulnerability in product.php in MihanTools 1.33 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2015-4074
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar
50RISK
open ↗Referência
CVE-2015-4074
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar
50RISK
open ↗Referência
CVE-2016-0784
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1
35RISK
open ↗Referência
CVE-2009-3330
SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Referência
CVE-2013-0249
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
28RISK
open ↗Referência✓ VexDay Proof
Woltlab Burning Board 2.3.5 - 'links.php' SQL Injection
SQL injection vulnerability in links.php in 4R Linklist 1.0 RC2 and earlier, a module for Woltlab Burning Board, allows
23RISK
open ↗Referência
CVE-2017-8635
Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Serve
35RISK
open ↗Referência
CVE-2019-11708
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result
90RISK
open ↗Referência✓ VexDay Proof
Philips VOIP841 Firmware 1.0.4.800 - Multiple Vulnerabilities
Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and
23RISK
open ↗Referência
CVE-2019-5825
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploi
90RISK
open ↗Referência
CVE-2009-3334
SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! Integrated Newsletters Component (aka JINC or com_jin
23RISK
open ↗Referência✓ VexDay Proof
empris r20020923 - 'phormationdir' Remote File Inclusion
PHP remote file inclusion vulnerability in sql_fcnsOLD.php in Emergenices Personnel Information System (Empris) 20020923
23RISK
open ↗Referência
CVE-2009-0658
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitra
60RISK
open ↗Referência✓ VexDay Proof
SDP Downloader 2.3.0 - '.asx' Local Heap Overflow (PoC)
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.