Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,607cataloged exploits

34,986CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 13,974VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecent popular risk

21,899 exploits

Referência✓ VexDay Proof

Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021)

CVE-2008-1087—remotewindows

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 200

35RISK

Referência✓ VexDay Proof

Affiliate Market 0.1 Beta - Cross-Site Scripting / SQL Injection

CVE-2008-1177—webappsphp

SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execu

23RISK

Referência✓ VexDay Proof

Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure

CVE-2008-1218—remotemultiple

Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs,

23RISK

Referência

CVE-2020-0618

CVE-2020-0618CRITICALunder attack

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page

100RISK

Referência

CVE-2020-0618

CVE-2020-0618CRITICALunder attack

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page

100RISK

Referência

CVE-2022-30333

CVE-2022-30333HIGHunder attackransomware

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o

100RISK

Referência

CVE-2020-7247

CVE-2020-7247CRITICALunder attack

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISK

Referência

CVE-2020-7247

CVE-2020-7247CRITICALunder attack

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISK

Referência

CVE-2020-7247

CVE-2020-7247CRITICALunder attack

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISK

Referência

CVE-2020-7247

CVE-2020-7247CRITICALunder attack

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISK

Referência

CVE-2020-7247

CVE-2020-7247CRITICALunder attack

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISK

Referência✓ VexDay Proof

phpBB Mod FileBase 2.0 - 'id' SQL Injection

CVE-2008-1305—webappsphp

SQL injection vulnerability in filebase.php in the Filebase mod for phpBB allows remote attackers to execute arbitrary S

23RISK

Referência

CVE-2023-32560

CVE-2023-32560HIGH

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup

78RISK

Referência

CVE-2023-32560

CVE-2023-32560HIGH

An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup

78RISK

Referência✓ VexDay Proof

Bloo 1.00 - Multiple SQL Injections

CVE-2008-1313—webappsphp

Multiple SQL injection vulnerabilities in index.php in Bloo 1.00 and earlier allow remote attackers to execute arbitrary

23RISK

Referência

CVE-2020-7209

CVE-2020-7209—

LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

60RISK

Referência

CVE-2020-7209

CVE-2020-7209—

LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

60RISK

Referência

CVE-2026-61514

CVE-2026-61514CRITICAL

Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456

48RISK

Referência

CVE-2026-61515

CVE-2026-61515CRITICAL

Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell

48RISK

Referência

CVE-2026-16548

CVE-2026-16548MEDIUM

Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint

33RISK

Referência

CVE-2026-16547

CVE-2026-16547MEDIUM

REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint

33RISK

Referência

CVE-2026-16546

CVE-2026-16546MEDIUM

Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp

33RISK

Referência

CVE-2026-16296

CVE-2026-16296MEDIUM

Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler

33RISK

Referência

CVE-2026-16295

CVE-2026-16295MEDIUM

Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

33RISK

Referência✓ VexDay Proof

Versant Object Database 7.0.1.3 - Commands Execution

CVE-2008-1319—remotewindows

Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 an

23RISK

Referência✓ VexDay Proof

EasyCalendar 4.0tr - Multiple Vulnerabilities

CVE-2008-1344—webappsphp

Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbi

23RISK

Referência

CVE-2026-61524

CVE-2026-61524HIGH

WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

41RISK

Referência

CVE-2019-11539

CVE-2019-11539HIGHunder attackransomware

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

100RISK

Referência

CVE-2019-11539

CVE-2019-11539HIGHunder attackransomware

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

100RISK

Referência✓ VexDay Proof

Knowledge Base Mod 2.0.2 - 'phpBB' Remote File Inclusion

CVE-2006-2134—webappsphp

PHP remote file inclusion vulnerability in /includes/kb_constants.php in Knowledge Base Mod for PHPbb 2.0.2 and earlier

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.