Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência✓ VexDay Proof
Internet PhotoShow (Special Edition) - Insecure Cookie Handling
CVE-2008-2282—webappsphp
admin.php in Internet Photoshow and Internet Photoshow Special Edition (SE) allows remote attackers to bypass authentica
23RISK
open ↗
Referência✓ VexDay Proof
idautomation bar code - ActiveX Multiple Vulnerabilities
CVE-2008-2283—remotewindows
IDAutomation allows remote attackers to overwrite arbitrary files via the argument to the (1) SaveBarCode and (2) SaveEn
23RISK
open ↗
Referência
CVE-2026-65053
CVE-2026-65053MEDIUM
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
33RISK
open ↗
Referência
CVE-2026-12129
CVE-2026-12129MEDIUM
CodeAstro Human Resource Management System Dashboard add_tod cross site scripting
33RISK
open ↗
Referência
CVE-2019-25746
CVE-2019-25746HIGH
WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter
41RISK
open ↗
Referência
CVE-2026-24067
CVE-2026-24067HIGH
Slate Digital Connect macOS XPC PID validation privilege escalation
41RISK
open ↗
Referência
CVE-2025-71319
CVE-2025-71319HIGH
image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
41RISK
open ↗
Referência★ 14
watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523
CVE-2026-10520CRITICALunder attack
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote
100RISK
open ↗
Referência
CVE-2014-0322
CVE-2014-0322HIGHunder attack
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code v
100RISK
open ↗
Referência✓ VexDay Proof
FAQ Manager 1.2 - 'categorie.php' SQL Injection
CVE-2008-5287—webappsphp
SQL injection vulnerability in catagorie.php in Werner Hilversum FAQ Manager 1.2 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
mini-pub 0.3 - Local Directory Traversal / File Disclosure
CVE-2008-5936—webappsphp
front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a fi
23RISK
open ↗
Referência
CVE-2015-6100
CVE-2015-6100—
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗
Referência✓ VexDay Proof
template creature - SQL Injection / File Disclosure
CVE-2008-5951—webappsphp
ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência
CVE-2015-6128
CVE-2015-6128—
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allo
60RISK
open ↗
Referência
CVE-2016-20068
CVE-2016-20068HIGH
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
41RISK
open ↗
Referência
CVE-2026-78141
CVE-2026-78141MEDIUM
Tenda CH22 exeCommand formexeCommand command injection
33RISK
open ↗
Referência
CVE-2015-6965
CVE-2015-6965—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for Wo
23RISK
open ↗
Referência
CVE-2016-6515
CVE-2016-6515—
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
35RISK
open ↗
Referência
CVE-2026-10246
CVE-2026-10246MEDIUM
SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting
33RISK
open ↗
Referência
CVE-2026-10242
CVE-2026-10242MEDIUM
itsourcecode Content Management System instructions.php sql injection
33RISK
open ↗
Referência
CVE-2026-9513
CVE-2026-9513MEDIUM
Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection
33RISK
open ↗
Referência
CVE-2021-47943
CVE-2021-47943HIGH
TextPattern CMS 4.8.7 Remote Code Execution via File Upload
41RISK
open ↗
Referência
CVE-2021-47943
CVE-2021-47943HIGH
TextPattern CMS 4.8.7 Remote Code Execution via File Upload
41RISK
open ↗
Referência
CVE-2021-47941
CVE-2021-47941HIGH
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params
41RISK
open ↗
Referência
CVE-2021-47940
CVE-2021-47940CRITICAL
WordPress Download From Files 1.48 Arbitrary File Upload
48RISK
open ↗
Referência✓ VexDay Proof
BBaCE 3.5 - '/includes/functions.php' Remote File Inclusion
CVE-2006-5187—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in Bulletin Board Ace (BBaCE) 3.5 and earlier allows r
23RISK
open ↗
Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
CVE-2007-3291—webappsphp
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2015-6545
CVE-2015-6545—
Cross-site request forgery (CSRF) vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the a
23RISK
open ↗
Referência✓ VexDay Proof
LiveCMS 3.4 - 'categoria.php?cid' SQL Injection
CVE-2007-3292—webappsphp
Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrar
23RISK
open ↗
Referência
CVE-2015-6639
CVE-2015-6639—
The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to
23RISK
open ↗
← previouspage 797 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.