Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2026-85398
CVE-2026-85398MEDIUM
code-projects Hospital Information System viewReq.php viewReq sql injection
33RISK
open ↗
Referência✓ VexDay Proof
Sugar Suite Open Source 4.2 - 'OptimisticLock' Command Execution
CVE-2006-2460—webappsphp
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variable
28RISK
open ↗
Referência
CVE-2018-12523
CVE-2018-12523—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provi
23RISK
open ↗
Referência
CVE-2018-4878
CVE-2018-4878HIGHunder attackransomware
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISK
open ↗
Referência
CVE-2019-5736
CVE-2019-5736—
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗
Referência
CVE-2006-2465
CVE-2006-2465—
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if
23RISK
open ↗
Referência
CVE-2017-2489
CVE-2017-2489—
An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the "Intel Graph
23RISK
open ↗
Referência
CVE-2006-2465
CVE-2006-2465—
Buffer overflow in MP3Info 0.8.4 allows attackers to execute arbitrary code via a long command line argument. NOTE: if
23RISK
open ↗
Referência✓ VexDay Proof
AIDeX Mini-WebServer 1.1 - Remote Crash (Denial of Service)
CVE-2006-6855—doswindows
AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service (daemon crash) via a flood
23RISK
open ↗
Referência
CVE-2026-116101
CVE-2026-116101MEDIUM
itsourcecode Online Cake Ordering System deletetransac.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
PHP-Update 2.7 - Multiple Vulnerabilities
CVE-2006-6879—webappsphp
Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated us
23RISK
open ↗
Referência✓ VexDay Proof
Sony CONNECT Player 4.x - '.m3u' Local Stack Overflow
CVE-2007-5709—localwindows
Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code
28RISK
open ↗
Referência
CVE-2018-0860
CVE-2018-0860—
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗
Referência✓ VexDay Proof
Adult Directory - 'cat_id' SQL Injection
CVE-2007-4056—webappsphp
SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2023-3219
CVE-2023-3219—
EventON < 2.1.2 - Unauthenticated Post Access via IDOR
38RISK
open ↗
Referência
CVE-2018-0837
CVE-2018-0837—
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗
Referência
CVE-2026-84832
CVE-2026-84832HIGH
Unsafe deserialization in the REST interface
21RISK
open ↗
Referência✓ VexDay Proof
NUNE News Script 2.0pre2 - Multiple Remote File Inclusions
CVE-2007-0143—webappsphp
Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2018-0972
CVE-2018-0972—
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informatio
23RISK
open ↗
Referência
CVE-2018-0974
CVE-2018-0974—
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informatio
23RISK
open ↗
Referência
CVE-2018-5977
CVE-2018-5977—
SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= r
23RISK
open ↗
Referência
CVE-2019-6340
CVE-2019-6340HIGHunder attack
Drupal core - Highly critical - Remote Code Execution
100RISK
open ↗
Referência
CVE-2023-33580
CVE-2023-33580—
Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" f
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07 - '.map' Local Arbitrary Code Execution (1)
CVE-2006-2494—localwindows
Stack-based buffer overflow in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a crafted .map f
23RISK
open ↗
Referência
CVE-2026-85397
CVE-2026-85397MEDIUM
code-projects Hospital Information System addReq.php findBySearch sql injection
33RISK
open ↗
Referência
CVE-2025-15485
CVE-2025-15485HIGH
Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
41RISK
open ↗
Referência
CVE-2026-92466
CVE-2026-92466HIGH
microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking
41RISK
open ↗
Referência
CVE-2026-92460
CVE-2026-92460HIGH
yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
41RISK
open ↗
Referência
CVE-2026-14562
CVE-2026-14562MEDIUM
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure
33RISK
open ↗
Referência
CVE-2026-14560
CVE-2026-14560CRITICAL
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
← previouspage 832 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.