Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,846 exploits
Referência✓ VexDay Proof
MLdonkey 2.9.7 - Arbitrary File Disclosure
CVE-2009-0753—remotemultiple
Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files vi
23RISK
open ↗
Referência
CVE-2017-1000486
CVE-2017-1000486CRITICALunder attack
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência✓ VexDay Proof
MyKtools 2.4 - 'langage' Local File Inclusion
CVE-2008-4781—webappsphp
Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary
23RISK
open ↗
Referência
CVE-2020-11652
CVE-2020-11652MEDIUMunder attack
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISK
open ↗
Referência✓ VexDay Proof
WOW Web On Windows ActiveX Control 2 - Remote Code Execution
CVE-2009-0389—remotewindows
Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attac
23RISK
open ↗
Referência
CVE-2016-0710
CVE-2016-0710—
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attacker
50RISK
open ↗
Referência
CVE-2019-8953
CVE-2019-8953—
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, re
35RISK
open ↗
Referência✓ VexDay Proof
Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
CVE-2009-0392—remotehardware
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to re
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer - WebViewFolderIcon setSlice() Overflow (Metasploit) (1)
CVE-2006-3730HIGHremotewindows
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service
68RISK
open ↗
Referência✓ VexDay Proof
Motorola Wimax modem CPEi300 - File Disclosure / Cross-Site Scripting
CVE-2009-0393—remotehardware
Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated user
23RISK
open ↗
Referência✓ VexDay Proof
PLE CMS 1.0 Beta 4.2 - Blind SQL Injection
CVE-2009-0394—webappsphp
SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
CVE-2009-0765—webappsphp
Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary l
23RISK
open ↗
Referência✓ VexDay Proof
DM FileManager 3.9.2 - Authentication Bypass
CVE-2009-1741—webappsphp
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow re
23RISK
open ↗
Referência
CVE-2014-9308
CVE-2014-9308—
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RISK
open ↗
Referência✓ VexDay Proof
K-Lite Mega Codec Pack 3.5.7.0 - Local Windows Explorer Denial of Service (PoC)
CVE-2008-5072—doswindows
vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗
Referência
CVE-2025-40552
CVE-2025-40552CRITICAL
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISK
open ↗
Referência
CVE-2017-8731
CVE-2017-8731—
Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the
35RISK
open ↗
Referência✓ VexDay Proof
SmartSiteCMS 1.0 - Blind SQL Injection
CVE-2009-0405—webappsphp
SQL injection vulnerability in articles.php in smartSite CMS 1.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2019-13068
CVE-2019-13068—
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the
35RISK
open ↗
Referência
CVE-2010-1622
CVE-2010-1622—
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote at
35RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
Referência
CVE-2016-8740
CVE-2016-8740—
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
45RISK
open ↗
Referência
CVE-2009-3446
CVE-2009-3446—
SQL injection vulnerability in the MyRemote Video Gallery (com_mytube) component 1.0 Beta for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2011-0522
CVE-2011-0522—
The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/code
35RISK
open ↗
Referência
CVE-2009-2638
CVE-2009-2638—
SQL injection vulnerability in the AkoBook (com_akobook) component 2.3 for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2006-3823
CVE-2006-3823—
SQL injection vulnerability in index.php in GeodesicSolutions (1) GeoAuctions Premier 2.0.3 and (2) GeoClassifieds Basic
23RISK
open ↗
Referência✓ VexDay Proof
Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass
CVE-2009-0409—webappsphp
SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência
CVE-2014-9308
CVE-2014-9308—
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RISK
open ↗
← previouspage 81 / 862next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.