Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-4182
CVE-2026-4182CRITICAL
D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow
48RISK
open ↗
Referência
CVE-2026-25873
CVE-2026-25873CRITICAL
OmniGen2-RL Reward Server Unsafe Deserialization RCE
48RISK
open ↗
Referência
CVE-2025-34096
CVE-2025-34096CRITICAL
Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp
63RISK
open ↗
Referência
CVE-2025-34096
CVE-2025-34096CRITICAL
Easy File Sharing HTTP Server 7.2 Buffer Overflow via POST to /sendemail.ghp
63RISK
open ↗
Referência
CVE-2010-10013
CVE-2010-10013CRITICAL
AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE
63RISK
open ↗
Referência
CVE-2010-10013
CVE-2010-10013CRITICAL
AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE
63RISK
open ↗
Referência
CVE-2012-5005
CVE-2012-5005—
Cross-site request forgery (CSRF) vulnerability in admin/admin_options.php in VR GPub 4.0 allows remote attackers to hij
23RISK
open ↗
Referência
CVE-2014-7951
CVE-2014-7951—
Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate att
23RISK
open ↗
Referência
CVE-2014-7951
CVE-2014-7951—
Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate att
23RISK
open ↗
Referência
CVE-2026-90506
CVE-2026-90506LOW
vvbbnn00 WARP-Clash-API Save Account Job race condition
28RISK
open ↗
Referência
CVE-2016-10074
CVE-2016-10074—
The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass
35RISK
open ↗
Referência
CVE-2015-7106
CVE-2015-7106—
The Intel Graphics Driver component in Apple OS X before 10.11.2 allows local users to gain privileges or cause a denial
23RISK
open ↗
Referência
CVE-2026-53365
CVE-2026-53365HIGH
vsock/virtio: fix zerocopy completion for multi-skb sends
41RISK
open ↗
Referência✓ VexDay Proof
EfesTECH Haber 5.0 - 'id' SQL Injection
CVE-2007-2662—webappsphp
SQL injection vulnerability in EfesTECH Haber 5.0 allows remote attackers to execute arbitrary SQL commands via the id p
23RISK
open ↗
Referência✓ VexDay Proof
Vanilla 1.1.3 - Blind SQL Injection
CVE-2007-5643—webappsphp
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2012-1897
CVE-2012-1897—
Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack
23RISK
open ↗
Referência
CVE-2012-5319
CVE-2012-5319—
Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows r
23RISK
open ↗
Referência
CVE-2026-103688
CVE-2026-103688CRITICAL
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2017-14097
CVE-2017-14097—
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below coul
28RISK
open ↗
Referência
CVE-2017-6805
CVE-2017-6805—
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read a
23RISK
open ↗
Referência
CVE-2022-3915
CVE-2022-3915CRITICAL
Dokan < 3.7.6 - Unauthenticated SQLi
48RISK
open ↗
Referência
CVE-2026-103382
CVE-2026-103382MEDIUM
Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
33RISK
open ↗
Referência✓ VexDay Proof
Mambo Component MamboWiki 0.9.6 - Remote File Inclusion
CVE-2006-4282—webappsphp
PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier f
23RISK
open ↗
Referência
CVE-2010-4872
CVE-2010-4872—
SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2156—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to in
23RISK
open ↗
Referência✓ VexDay Proof
InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion
CVE-2007-5674—webappsphp
Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2010-2853
CVE-2010-2853—
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2010-2853
CVE-2010-2853—
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component jooget 2.6.8 - SQL Injection
CVE-2008-0829—webappsphp
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo
23RISK
open ↗
Referência
CVE-2026-14752
CVE-2026-14752MEDIUM
mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting
33RISK
open ↗
← previouspage 780 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.