Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,677cataloged exploits

39,951CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,373VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

25,887 exploits

Referência

CVE-2015-5127

CVE-2015-5127—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linu

35RISK

open ↗

Referência

CVE-2018-0706

CVE-2018-0706—

Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate

50RISK

open ↗

Referência

CVE-2011-0514

CVE-2011-0514—

The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash)

50RISK

open ↗

Referência✓ VexDay Proof

SoftArtisans SAFileUp 5.0.14 - 'viewsrc.asp' Script Source Disclosure

CVE-2006-6865—webappsasp

Directory traversal vulnerability in SAFileUpSamples/util/viewsrc.asp in SoftArtisans FileUp (SAFileUp) 5.0.14 allows re

23RISK

open ↗

Referência✓ VexDay Proof

SFS EZ Gaming Directory - 'directory.php' SQL Injection

CVE-2008-6781—webappsphp

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_phocadocumentation - 'id' SQL Injection

CVE-2009-0702—webappsphp

SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

PHPFootball 1.6 - Remote Hash Disclosure

CVE-2009-0711—webappsphp

filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Acco

23RISK

open ↗

Referência

CVE-2009-3590

CVE-2009-3590—

SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2012-4878

CVE-2012-4878—

Absolute path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to r

38RISK

open ↗

Referência

CVE-2015-5134

CVE-2015-5134—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linu

35RISK

open ↗

Referência

CVE-2020-16009

CVE-2020-16009HIGHunder attack

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

83RISK

open ↗

Referência✓ VexDay Proof

Potato News 1.0.0 - Local File Inclusion

CVE-2009-0722—webappsphp

Directory traversal vulnerability in admin.php in Potato News 1.0.0 allows remote attackers to include and execute arbit

23RISK

open ↗

Referência

CVE-2018-14392

CVE-2018-14392—

The New Threads plugin before 1.2 for MyBB has XSS.

35RISK

open ↗

Referência✓ VexDay Proof

Article Publisher PRO 1.5 - Authentication Bypass

CVE-2008-4901—webappsphp

SQL injection vulnerability in admin/admin.php in Article Publisher Pro 1.5 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2025-48828

CVE-2025-48828CRITICAL

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t

75RISK

open ↗

Referência

CVE-2013-3563

CVE-2013-3563—

Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a de

50RISK

open ↗

Referência

CVE-2016-0170

CVE-2016-0170—

GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

35RISK

open ↗

Referência

CVE-2017-9232

CVE-2017-9232—

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate pe

50RISK

open ↗

Referência

CVE-2021-40875

CVE-2021-40875—

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac

50RISK

open ↗

Referência

CVE-2023-4547

CVE-2023-4547MEDIUM

SPA-Cart eCommerce CMS search cross site scripting

60RISK

open ↗

Referência

CVE-2009-3642

CVE-2009-3642—

Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

TurnkeyForms Text Link Sales - 'id' Cross-Site Scripting / SQL Injection

CVE-2008-5486—webappsphp

SQL injection vulnerability in admin.php in TurnkeyForms Text Link Sales allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2009-0182

CVE-2009-0182—

Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in

50RISK

open ↗

Referência

CVE-2020-20142

CVE-2020-20142—

Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table &

23RISK

open ↗

Referência✓ VexDay Proof

Free Arcade Script 1.0 - Local File Inclusion Command Execution

CVE-2009-0731—webappsphp

Directory traversal vulnerability in pages/play.php in Free Arcade Script 1.0 allows remote attackers to include and exe

23RISK

open ↗

Referência✓ VexDay Proof

Papoo CMS 3.x - 'pfadhier' Local File Inclusion

CVE-2009-0735—webappsphp

Directory traversal vulnerability in lib/classes/message_class.php in Papoo CMS 3.6, when register_globals is enabled an

23RISK

open ↗

Referência✓ VexDay Proof

elvin bts 1.2.0 - Multiple Vulnerabilities

CVE-2009-2124—webappsphp

Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary lo

23RISK

open ↗

Referência

CVE-2023-50919

CVE-2023-50919CRITICAL

An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string

75RISK

open ↗

Referência

CVE-2014-9566

CVE-2014-9566—

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

50RISK

open ↗

Referência

CVE-2015-3093

CVE-2015-3093—

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460

35RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.