Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2026-82527
CVE-2026-82527HIGH
R2R 3.6.6 SQL Injection via Retrieval Search Filter Key
41RISK
open ↗
Referência✓ VexDay Proof
IGSuite 3.2.4 - Reverse Shell / Blind SQL Injection
CVE-2008-2835—webappsphp
SQL injection vulnerability in cgi-bin/igsuite in IGSuite 3.2.4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
WebCalendar 1.0.4 - 'includedir' Remote File Inclusion
CVE-2008-2836—webappsphp
PHP remote file inclusion vulnerability in send_reminders.php in WebCalendar 1.0.4 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2024-14037
CVE-2024-14037CRITICAL
Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob
48RISK
open ↗
Referência
CVE-2013-1763
CVE-2013-1763—
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows l
23RISK
open ↗
Referência
CVE-2014-4936
CVE-2014-4936—
The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE)
43RISK
open ↗
Referência
CVE-2026-11490
CVE-2026-11490MEDIUM
code-projects Online Music Site Search.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2882—webappsphp
upgrade.asp in sHibby sHop 2.2 and earlier does not require administrative authentication, which allows remote attackers
23RISK
open ↗
Referência
CVE-2026-19715
CVE-2026-19715HIGH
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
41RISK
open ↗
Referência
CVE-2026-9584
CVE-2026-9584MEDIUM
code-projects Project Management System Login chk.php sql injection
33RISK
open ↗
Referência
CVE-2026-106099
CVE-2026-106099MEDIUM
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
33RISK
open ↗
Referência✓ VexDay Proof
Dana IRC 1.3 - Remote Buffer Overflow (PoC)
CVE-2008-2922—doswindows
Stack-based buffer overflow in artegic Dana IRC client 1.3 and earlier allows remote attackers to cause a denial of serv
23RISK
open ↗
Referência
CVE-2026-105975
CVE-2026-105975MEDIUM
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
33RISK
open ↗
Referência
CVE-2026-103307
CVE-2026-103307HIGH
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
41RISK
open ↗
Referência
CVE-2013-1605
CVE-2013-1605—
Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitra
28RISK
open ↗
Referência
CVE-2026-8289
CVE-2026-8289MEDIUM
Open5GS SMF nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf denial of service
33RISK
open ↗
Referência
CVE-2024-25735
CVE-2024-25735CRITICAL
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext password
75RISK
open ↗
Referência
CVE-2013-3214
CVE-2013-3214—
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
60RISK
open ↗
Referência
CVE-2012-2591
CVE-2012-2591—
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attack
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3117—webappsphp
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3118—webappsphp
SQL injection vulnerability in play.php in PHPmotion 2.0 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Hotel Script 1.0 - SQL Injection
CVE-2008-3124—webappsphp
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2014-5301
CVE-2014-5301—
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 t
60RISK
open ↗
Referência
CVE-2012-2924
CVE-2012-2924—
PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attacker
23RISK
open ↗
Referência
CVE-2026-6186
CVE-2026-6186HIGH
UTT HiPER 1200GW formNatStaticMap strcpy buffer overflow
41RISK
open ↗
Referência
CVE-2014-5464
CVE-2014-5464—
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
23RISK
open ↗
Referência
CVE-2014-6037
CVE-2014-6037—
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
60RISK
open ↗
Referência✓ VexDay Proof
TWiki 4.2.0 - 'configure' Remote File Disclosure
CVE-2008-3195—webappscgi
Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide
23RISK
open ↗
Referência✓ VexDay Proof
AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete
CVE-2008-3203—webappsphp
js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a
23RISK
open ↗
Referência✓ VexDay Proof
Ultrastats 0.2.142 - 'players-detail.php' Blind SQL Injection
CVE-2008-3241—webappsphp
SQL injection vulnerability in players-detail.php in UltraStats 0.2.136, 0.2.140, and 0.2.142 allows remote attackers to
23RISK
open ↗
← previouspage 809 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.