Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,887 exploits
Referência
CVE-2015-3082
CVE-2015-3082—
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460
35RISK
open ↗
Referência
CVE-2016-6210
CVE-2016-6210MEDIUM
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
70RISK
open ↗
Referência
CVE-2016-7274
CVE-2016-7274—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
35RISK
open ↗
Referência✓ VexDay Proof
Flatchat 3.0 - 'pmscript.php' Local File Inclusion
CVE-2009-1486—webappsphp
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
fungamez rc1 - Authentication Bypass / Local File Inclusion
CVE-2009-1488—webappsphp
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
iDB 0.2.5pa SVN 243 - 'skin' Local File Inclusion
CVE-2009-1498—webappsphp
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alp
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component MailTo - 'article' SQL Injection
CVE-2009-1499—webappsphp
SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2009-2781
CVE-2009-2781—
SQL injection vulnerability in forum.php in Arab Portal 2.x, when magic_quotes_gpc is disabled, allows remote authentica
23RISK
open ↗
Referência
CVE-2026-109188
CVE-2026-109188MEDIUM
jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
33RISK
open ↗
Referência
CVE-2011-5165
CVE-2011-5165—
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗
Referência✓ VexDay Proof
W1L3D4 philboard 1.2 - Blind SQL Injection / Cross-Site Scripting
CVE-2008-5192—webappsphp
SQL injection vulnerability in forum.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2017-0121
CVE-2017-0121—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
35RISK
open ↗
Referência✓ VexDay Proof
Mediatheka 4.2 - Blind SQL Injection
CVE-2008-5895—webappsphp
SQL injection vulnerability in connection.php in Mediatheka 4.2 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2025-34112
CVE-2025-34112CRITICAL
Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE
63RISK
open ↗
Referência
CVE-2014-1649
CVE-2014-1649—
The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functional
50RISK
open ↗
Referência
CVE-2014-6436
CVE-2014-6436—
Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices improperly manage sessions, which allows remote attackers to
35RISK
open ↗
Referência✓ VexDay Proof
phpGroupWare 0.9.16.010 - 'GLOBALS[]' Remote Code Execution
CVE-2006-4458—webappsphp
Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allow
23RISK
open ↗
Referência✓ VexDay Proof
eLitius 1.0 - 'banner-details.php?id' SQL Injection
CVE-2009-1506—webappsphp
SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2011-5165
CVE-2011-5165—
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗
Referência✓ VexDay Proof
Google Chrome 1.0.154.53 - Null Pointer Remote Crash
CVE-2009-1514—doswindows
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application
23RISK
open ↗
Referência
CVE-2009-2788
CVE-2009-2788—
Multiple SQL injection vulnerabilities in Mobilelib GOLD 3 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2012-0266
CVE-2012-0266—
Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitr
50RISK
open ↗
Referência
CVE-2019-0841
CVE-2019-0841HIGHunder attackransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li
98RISK
open ↗
Referência
CVE-2019-0841
CVE-2019-0841HIGHunder attackransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li
98RISK
open ↗
Referência
CVE-2019-0841
CVE-2019-0841HIGHunder attackransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard li
98RISK
open ↗
Referência✓ VexDay Proof
Umer Inc Songs Portal Script - 'id' SQL Injection
CVE-2008-5921—webappsphp
SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2026-109185
CVE-2026-109185HIGH
jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
41RISK
open ↗
Referência
CVE-2026-109184
CVE-2026-109184MEDIUM
jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
33RISK
open ↗
Referência
CVE-2026-109183
CVE-2026-109183MEDIUM
jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
33RISK
open ↗
Referência✓ VexDay Proof
EZContents CMS 2.0.3 - Multiple Local File Inclusions
CVE-2008-7055—webappsphp
module.php in ezContents 2.0.3 allows remote attackers to bypass the directory traversal protection mechanism to include
23RISK
open ↗
← previouspage 94 / 863next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.