Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2018-25232
Softros LAN Messenger 9.2 Denial of Service via Log Files Location
33RISK
open ↗Referência
CVE-2014-6287
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗Referência
CVE-2012-3577
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress
28RISK
open ↗Referência✓ VexDay Proof
Exponent CMS 0.96.3 - 'view' Remote Command Execution
Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
PHP-Nuke Module books SQL - 'cid' SQL Injection
SQL injection vulnerability in the Books module of PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attacke
23RISK
open ↗Referência
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR
33RISK
open ↗Referência
CVE-2013-2678
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers
28RISK
open ↗Referência
CVE-2017-0286
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗Referência
CVE-2018-9106
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extensio
23RISK
open ↗Referência
CVE-2013-5120
SQL injection vulnerability in PHPFox before 3.6.0 (build4) allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência
CVE-2026-13525
CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection
33RISK
open ↗Referência
CVE-2026-13521
SourceCodester Class and Exam Timetabling System preview5.php sql injection
33RISK
open ↗Referência
CVE-2026-13520
itsourcecode Hospital Management System Appointment appointmentapproval.php sql injection
33RISK
open ↗Referência✓ VexDay Proof
Anzio Web Print Object 3.2.30 - ActiveX Buffer Overflow
Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Pri
28RISK
open ↗Referência
CVE-2018-9237
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.
23RISK
open ↗Referência
CVE-2026-85350
UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
33RISK
open ↗Referência
CVE-2026-16051
WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
48RISK
open ↗Referência
CVE-2026-16557
Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins
33RISK
open ↗Referência✓ VexDay Proof
Dayfox Blog 4 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute
23RISK
open ↗Referência
CVE-2018-9238
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.