Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,662cataloged exploits
39,951CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,369VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,887 exploits
Referência✓ VexDay Proof
Torbstoff News 4 - 'pfad' Remote File Inclusion
PHP remote file inclusion vulnerability in news.php in Torbstoff News 4 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência✓ VexDay Proof
Ol BookMarks Manager 0.7.4 - 'root' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP
28RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual Basic 6.0 Project - Company Name Stack Overflow (PoC)
Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial
35RISK
open ↗Referência
CVE-2017-8682
Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a
35RISK
open ↗Referência
CVE-2026-100875
mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection
33RISK
open ↗Referência✓ VexDay Proof
YourFreeWorld Scrolling Text Ads - SQL Injection
SQL injection vulnerability in tr1.php in YourFreeWorld Scrolling Text Ads Script allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2016-6909
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
35RISK
open ↗Referência
CVE-2026-110632
Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
48RISK
open ↗Referência
CVE-2026-110604
Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
28RISK
open ↗Referência✓ VexDay Proof
Pilot Group PG Roommate Finder Solution - Authentication Bypass
SQL injection vulnerability in admin/index.php in PG Roommate Finder Solution allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
IF-CMS 2.0 - 'id' Blind SQL Injection
SQL injection vulnerability in frame.php in Rhadrix If-CMS 2.07 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
WinRAR 3.60 Beta 6 (French) - SFX Path Local Stack Overflow
Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
23RISK
open ↗Referência✓ VexDay Proof
WinRAR 3.60 Beta 6 - SFX Path Local Stack Overflow
Stack-based buffer overflow in the SFX module in WinRAR before 3.60 beta 8 has unspecified vectors and impact.
23RISK
open ↗Referência✓ VexDay Proof
Nokia N95-8 browser - 'setAttributeNode' Method Crash
The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) v
23RISK
open ↗Referência✓ VexDay Proof
Dokuwiki 2009-02-14 - Local File Inclusion
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote att
28RISK
open ↗Referência
CVE-2012-4361
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to exe
50RISK
open ↗Referência✓ VexDay Proof
Trend Micro Internet Security Pro 2009 - Priviliege Escalation
The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Securit
23RISK
open ↗Referência
CVE-2020-17456
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi pa
60RISK
open ↗Referência✓ VexDay Proof
Bandwebsite 1.5 - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in info.php in Bandwebsite (aka Bandsite portal system) 1.5 allows remote attac
23RISK
open ↗Referência
CVE-2018-16323
ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha
35RISK
open ↗Referência✓ VexDay Proof
Multiple Vendor - PF Null Pointer Dereference
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirO
23RISK
open ↗Referência
CVE-2017-11890
Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Win
35RISK
open ↗Referência
Comtrend VR-3033 - Command Injection
Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabiliti
45RISK
open ↗Referência✓ VexDay Proof
Mambo Component Mam-Moodle alpha - Remote File Inclusion
PHP remote file inclusion vulnerability in moodle.php in Mam-moodle alpha component (com_moodle) for Mambo allows remote
23RISK
open ↗Referência
CVE-2017-16720
A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within th
35RISK
open ↗Referência
CVE-2017-11793
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RISK
open ↗Referência✓ VexDay Proof
Logz podcast CMS 1.3.1 - 'art' SQL Injection
SQL injection vulnerability in fichiers/add_url.php in Logz podcast CMS 1.3.1, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência
CVE-2019-17503
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG
50RISK
open ↗Referência
CVE-2023-28252
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.