Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,639cataloged exploits
40,918CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,402VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência✓ VexDay Proof
ArcadeBuilder Game Portal Manager 1.7 - SQL Injection
SQL injection vulnerability in ArcadeBuilder Game Portal Manager 1.7 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2026-94263
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
33RISK
open ↗Referência
CVE-2017-15968
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
23RISK
open ↗Referência✓ VexDay Proof
Redaxo 3.2 - 'INCLUDE_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL
23RISK
open ↗Referência✓ VexDay Proof
Click N Print Coupons 2006.01 - 'key' SQL Injection
SQL injection vulnerability in coupon_detail.asp in Website Designs For Less Click N' Print Coupons 2005.01 and earlier
23RISK
open ↗Referência✓ VexDay Proof
Virtue Shopping Mall - 'cid' SQL Injection
SQL injection vulnerability in products.php in Virtue Shopping Mall allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2009-2772
Multiple cross-site scripting (XSS) vulnerabilities in PG Roommate Finder Solution allow remote attackers to inject arbi
23RISK
open ↗Referência
CVE-2014-8507
Multiple SQL injection vulnerabilities in the queryLastApp method in packages/WAPPushManager/src/com/android/smspush/Wap
23RISK
open ↗Referência★ 7
CVE-2025-0364: BigAnt Server RCE Exploit
BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE
48RISK
open ↗Referência✓ VexDay Proof
otscms 2.1.5 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in forum.php in Open Tibia Server CMS (OTSCMS) 2.1.5 and earlier allows remote
23RISK
open ↗Referência
CVE-2016-9111
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication r
23RISK
open ↗Referência✓ VexDay Proof
GL-SH Deaf Forum 6.4.4 - Local File Inclusion
Multiple directory traversal vulnerabilities in GL-SH Deaf Forum 6.4.4 and earlier allow remote attackers to include and
23RISK
open ↗Referência
CVE-2010-1983
Directory traversal vulnerability in the redTWITTER (com_redtwitter) component 1.0.x including 1.0b11 for Joomla! allows
43RISK
open ↗Referência
CVE-2016-9111
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication r
23RISK
open ↗Referência
CVE-2017-15968
MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.
23RISK
open ↗Referência✓ VexDay Proof
Alstrasoft Article Manager Pro 1.6 - Authentication Bypass
SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute
23RISK
open ↗Referência
CVE-2026-113499
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
41RISK
open ↗Referência
CVE-2026-10165
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
41RISK
open ↗Referência✓ VexDay Proof
OneCMS 2.4 - SQL Injection / Upload
Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2026-113472
Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
33RISK
open ↗Referência
CVE-2026-66754
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
41RISK
open ↗Referência✓ VexDay Proof
Claroline 1.7.6 - 'includePath' Remote Code Execution
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP co
28RISK
open ↗Referência
CVE-2009-3512
Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗Referência✓ VexDay Proof
MyCMS 0.9.8 - Remote Command Execution (1)
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a
23RISK
open ↗Referência
CVE-2026-5978
Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.