Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits

39,907CVEs with public exploitation

24,696lab-tested

All Referência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

25,846 exploits

Referência✓ VexDay Proof

SunOS Release 5.11 snv_101b - Remote IPv6 Crash

CVE-2009-0304—dossolaris

The kernel in Sun Solaris 10 and 11 snv_101b, and OpenSolaris before snv_108, allows remote attackers to cause a denial

23RISK

open ↗

Referência✓ VexDay Proof

PHP-Lance 1.52 - 'catid' SQL Injection

CVE-2008-4716—webappsphp

SQL injection vulnerability in show.php in BitmixSoft PHP-Lance 1.52 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência★ 30

watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819

CVE-2025-57819CRITICALunder attack

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

open ↗

Referência✓ VexDay Proof

Visagesoft eXPert PDF ViewerX - 'VSPDFViewerX.ocx' File Overwrite

CVE-2008-4919—remotewindows

Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

FlexCell Grid Control 5.6.9 - Remote File Overwrite

CVE-2009-0301—remotewindows

Multiple insecure method vulnerabilities in the FlexCell.Grid ActiveX control (FlexCell.ocx) in FlexCell Grid Control 5.

23RISK

open ↗

Referência✓ VexDay Proof

Ninja Blog 4.8 - Remote Information Disclosure

CVE-2009-0325—webappsphp

Directory traversal vulnerability in entries/index.php in Ninja Blog 4.8, when magic_quotes_gpc is disabled, allows remo

23RISK

open ↗

Referência✓ VexDay Proof

Scout Portal Toolkit 1.4.0 - 'forumid' SQL Injection

CVE-2006-3309—webappsphp

SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

2DayBiz Business Community Script - Multiple Vulnerabilities

CVE-2009-1652—webappsphp

admin/adminaddeditdetails.php in Business Community Script does not properly restrict access, which allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

PAPOO 3_RC3 - SQL Injection / Admin Credentials Disclosure

CVE-2006-3572—webappsphp

SQL injection vulnerability in forumthread.php in Papoo 3 RC3 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2010-2343

CVE-2010-2343—

Stack-based buffer overflow in D.R. Software Audio Converter 8.1, 2007, and 8.05 allows remote attackers to execute arbi

50RISK

open ↗

Referência

CVE-2018-8734

CVE-2018-8734—

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker

50RISK

open ↗

Referência✓ VexDay Proof

SiteXS CMS 0.1.1 - Local File Inclusion

CVE-2009-0371—webappsphp

Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and exe

23RISK

open ↗

Referência

CVE-2008-3922

CVE-2008-3922—

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences

50RISK

open ↗

Referência

CVE-2016-7434

CVE-2016-7434—

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf

35RISK

open ↗

Referência

CVE-2019-11447

CVE-2019-11447—

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

35RISK

open ↗

Referência✓ VexDay Proof

PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusions

CVE-2006-6760—webappsphp

Multiple PHP remote file inclusion vulnerabilities in template.php in Phpmymanga 0.8.1 and earlier allow remote attacker

23RISK

open ↗

Referência

CVE-2019-11447

CVE-2019-11447—

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

35RISK

open ↗

Referência

CVE-2019-9760

CVE-2019-9760—

FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-cont

50RISK

open ↗

Referência

CVE-2023-24078

CVE-2023-24078HIGH

Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the c

53RISK

open ↗

Referência✓ VexDay Proof

QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection

CVE-2008-4773—webappsphp

Directory traversal vulnerability in main/main.php in QuestCMS allows remote attackers to read arbitrary local files via

23RISK

open ↗

Referência✓ VexDay Proof

WinFTP Server 2.3.0 - 'LIST' (Authenticated) Remote Buffer Overflow

CVE-2009-0351—remotewindows

Stack-based buffer overflow in WFTPSRV.exe in WinFTP 2.3.0 allows remote authenticated users to execute arbitrary code v

23RISK

open ↗

Referência

CVE-2017-13772

CVE-2017-13772—

Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated

35RISK

open ↗

Referência

CVE-2020-1054

CVE-2020-1054HIGHunder attack

Win32k Elevation of Privilege Vulnerability

98RISK

open ↗

Referência

CVE-2013-1359

CVE-2013-1359—

An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5

60RISK

open ↗

Referência✓ VexDay Proof

TugZip 3.00 Archiver - '.zip' Local Buffer Overflow

CVE-2008-4779—localwindows

Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary

50RISK

open ↗

Referência

CVE-2017-8734

CVE-2017-8734—

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arb

35RISK

open ↗

Referência✓ VexDay Proof

DevelopItEasy Membership System 1.3 - Authentication Bypass

CVE-2008-5054—webappsphp

Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2009-3430

CVE-2009-3430—

SQL injection vulnerability in login.php in Allomani Mobile 2.5 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_pcchess - Blind SQL Injection

CVE-2009-0379—webappsphp

SQL injection vulnerability in the Prince Clan Chess Club (com_pcchess) component for Joomla! allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

UltraVNC/TightVNC (Multiple VNC Clients) - Multiple Integer Overflows (PoC)

CVE-2009-0388—doswindows

Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to ca

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.