Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,149cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,342VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
25,557 exploits
Referência
CVE-2010-5018
CVE-2010-5018—
Cross-site scripting (XSS) vulnerability in products/classified/headersearch.php in 2daybiz Online Classified Script all
23RISK
open ↗
Referência
CVE-2010-5019
CVE-2010-5019—
SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Mod Small ShoutBox 1.4 - Remote Edit/Delete Messages
CVE-2008-6301—webappsphp
SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to e
23RISK
open ↗
Referência
CVE-2023-33246
CVE-2023-33246CRITICALunder attack
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISK
open ↗
Referência
CVE-2023-33246
CVE-2023-33246CRITICALunder attack
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISK
open ↗
Referência★ 104
CVE-2023-33246 RocketMQ RCE Detect By Version and Exploit
CVE-2023-33246CRITICALunder attack
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISK
open ↗
Referência
CVE-2023-32560
CVE-2023-32560HIGH
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup
78RISK
open ↗
Referência
CVE-2023-46747
CVE-2023-46747CRITICALunder attackransomware
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
100RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Recipes Listing Portal - Arbitrary File Upload
CVE-2008-6943—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execut
23RISK
open ↗
Referência
CVE-2026-10815
CVE-2026-10815MEDIUM
LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization
33RISK
open ↗
Referência✓ VexDay Proof
ScriptsFeed (SF) Auto Classifieds Software - Arbitrary File Upload
CVE-2008-6944—webappsphp
Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
xoops module tsdisplay4xoops 0.1 - Remote File Inclusion
CVE-2007-2091—webappsphp
PHP remote file inclusion vulnerability in blocks/tsdisplay4xoops_block2.php in tsdisplay4xoops (TSD4XOOPS, aka the Team
23RISK
open ↗
Referência
CVE-2010-5033
CVE-2010-5033—
SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2019-9194
CVE-2019-9194—
elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.
60RISK
open ↗
Referência
CVE-2026-10814
CVE-2026-10814LOW
milvus-io milvus Grantee ID Hash kv_catalog.go weak hash
28RISK
open ↗
Referência
CVE-2026-10812
CVE-2026-10812LOW
zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash
28RISK
open ↗
Referência
CVE-2020-8260
CVE-2020-8260HIGHunder attack
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform
100RISK
open ↗
Referência
CVE-2026-8037
CVE-2026-8037CRITICALunder attack
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
100RISK
open ↗
Referência
CVE-2026-10804
CVE-2026-10804LOW
Streamlit Palette hashing.py weak hash
28RISK
open ↗
Referência✓ VexDay Proof
Simple Machines Forum (SMF) 1.1.5 (Windows x86) - Admin Reset Password
CVE-2008-6971—webappsphp
The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before
23RISK
open ↗
Referência
CVE-2026-10288
CVE-2026-10288MEDIUM
code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication
33RISK
open ↗
Referência
CVE-2021-25298
CVE-2021-25298HIGHunder attack
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi
100RISK
open ↗
Referência
CVE-2021-25298
CVE-2021-25298HIGHunder attack
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi
100RISK
open ↗
Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - Automatic File Download
CVE-2008-6996—remotewindows
Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for rem
23RISK
open ↗
Referência
CVE-2026-7229
CVE-2026-7229MEDIUM
code-projects Coaching Management System POST reply.php sql injection
33RISK
open ↗
Referência✓ VexDay Proof
Winamp 5.3 - '.wmv' Remote Denial of Service
CVE-2007-2180—doswindows
Buffer overflow in Nullsoft Winamp 5.3 allows user-assisted remote attackers to cause a denial of service (crash) via a
23RISK
open ↗
Referência
CVE-2008-7000
CVE-2008-7000—
PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2026-10286
CVE-2026-10286MEDIUM
CodeAstro Payroll System home_employee.php sql injection
33RISK
open ↗
Referência
CVE-2010-5043
CVE-2010-5043—
SQL injection vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remote authentica
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server - Universal Code Execution (MS08-067)
CVE-2008-4250CRITICALunder attackremotewindows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗
← previouspage 9 / 852next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.