Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,887 exploits
Referência✓ VexDay Proof
DeluxeBB 1.3 - 'qorder' SQL Injection
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2009-2611
Directory traversal vulnerability in infusions/last_seen_users_panel/last_seen_users_panel.php in MyFusion (aka MyF) 6 B
23RISK
open ↗Referência
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value
60RISK
open ↗Referência
CVE-2018-15812
DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expect
50RISK
open ↗Referência
CVE-2019-17026
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are
83RISK
open ↗Referência
CVE-2009-3320
Cross-site scripting (XSS) vulnerability in scrivi.php in Zenas PaoLink (aka Pao-Link) 1.0 allows remote attackers to in
23RISK
open ↗Referência
CVE-2019-9692
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard
50RISK
open ↗Referência✓ VexDay Proof
YAP 1.1.1 - Blind SQL Injection / SQL Injection
Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência✓ VexDay Proof
My Simple Forum 3.0 - Local File Inclusion
Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows
23RISK
open ↗Referência
CVE-2009-3331
Multiple PHP remote file inclusion vulnerabilities in DDL CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Referência
CVE-2016-3976
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary fil
83RISK
open ↗Referência
CVE-2013-5036
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter t
50RISK
open ↗Referência
CVE-2017-11903
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
35RISK
open ↗Referência
CVE-2023-6875
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
85RISK
open ↗Referência
CVE-2018-10201
An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible t
50RISK
open ↗Referência
CVE-2014-6446
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows
50RISK
open ↗Referência
CVE-2016-0956
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
35RISK
open ↗Referência
CVE-2018-7719
Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.
50RISK
open ↗Referência
CVE-2019-15276
Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability
53RISK
open ↗Referência
CVE-2026-104644
Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
33RISK
open ↗Referência✓ VexDay Proof
Joomla! Component AlphaUserPoints - SQL Injection
SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints (com_alphauserpoints) compo
23RISK
open ↗Referência✓ VexDay Proof
FTP Now 2.6 Server - Response Remote Crash (PoC)
Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to caus
23RISK
open ↗Referência✓ VexDay Proof
Turnkey Arcade Script - SQL Injection (1)
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Referência
CVE-2010-4749
Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
Bloginator 1a - SQL Injection / Command Injection (via Cookie Bypass )
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência
CVE-2009-2637
PHP remote file inclusion vulnerability in toolbar_ext.php in the BookLibrary (com_booklibrary) component 1.5.2.4 Basic
23RISK
open ↗Referência
CVE-2012-6530
Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users w
50RISK
open ↗Referência
CVE-2016-0956
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
35RISK
open ↗Referência
CVE-2018-20470
An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerab
50RISK
open ↗Referência
CVE-2016-4971
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.