Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2026-7240
Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection
48RISK
open ↗Referência
CVE-2026-7227
SourceCodester Pizzafy Ecommerce System ajax.php login sql injection
33RISK
open ↗Referência
CVE-2026-84425
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service
33RISK
open ↗Referência✓ VexDay Proof
Community CMS 0.4 - 'id' Blind SQL Injection
SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
DMXReady Classified Listings Manager 1.1 - SQL Injection
SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Classified Listings Manager 1.1 and
23RISK
open ↗Referência✓ VexDay Proof
PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass
PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to c
23RISK
open ↗Referência✓ VexDay Proof
PowerTCP FTP Module - Multiple Techniques (SEH HeapSpray)
Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remo
28RISK
open ↗Referência✓ VexDay Proof
XOOPS Module makale 0.26 - SQL Injection
SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote
23RISK
open ↗Referência✓ VexDay Proof
PHPbbBook 1.3 - 'bbcode.php?l' Local File Inclusion
Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute
23RISK
open ↗Referência✓ VexDay Proof
Elecard AVC HD player - '.m3u' / '.xpl' Local Stack Overflow (PoC)
Stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an
23RISK
open ↗Referência
CVE-2009-3528
SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2015-4630
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x
23RISK
open ↗Referência
CVE-2014-7280
Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web s
23RISK
open ↗Referência
CVE-2015-4664
An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers t
28RISK
open ↗Referência
CVE-2015-4683
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potenti
23RISK
open ↗Referência
CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RISK
open ↗Referência
CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RISK
open ↗Referência
CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due
100RISK
open ↗Referência
CVE-2015-4038
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an i
23RISK
open ↗Referência
CVE-2015-6811
SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlie
23RISK
open ↗Referência
CVE-2026-8759
xiandafu beetl SpELFunction SpELFunction.java expression language injection
33RISK
open ↗Referência
CVE-2026-84936
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat
33RISK
open ↗Referência✓ VexDay Proof
Mihalism Multi Host Download - 'Username' Blind SQL Injection
SQL injection vulnerability in users.php in Mihalism Multi Host allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência✓ VexDay Proof
Nokia N95-8 browser - 'setAttributeNode' Method Crash
The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) v
23RISK
open ↗Referência
CVE-2021-38647
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
100RISK
open ↗Referência✓ VexDay Proof
Dream4 Koobi CMS 4.3.0 < 4.2.3 - 'categ' SQL Injection
SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência
CVE-2014-3544
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before
23RISK
open ↗Referência✓ VexDay Proof
Dream4 Koobi Pro 6.25 Showimages - 'galid' SQL Injection
SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.