Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,401cataloged exploits

35,511CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecent popular risk

22,301 exploits

Referência

CVE-2011-5005

CVE-2011-5005—

Unrestricted file upload vulnerability in QuiXplorer 2.3 and earlier allows remote attackers to execute arbitrary code b

23RISK

open ↗

Referência

CVE-2026-7744

CVE-2026-7744MEDIUM

CodeAstro Online Classroom addnewstudent sql injection

33RISK

open ↗

Referência

CVE-2026-56122

CVE-2026-56122HIGH

Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths

41RISK

open ↗

Referência

CVE-2026-9702

CVE-2026-9702HIGH

InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

41RISK

open ↗

Referência

CVE-2010-1653

CVE-2010-1653—

Directory traversal vulnerability in graphics.php in the Graphics (com_graphics) component 1.0.6 and 1.5.0 for Joomla! a

43RISK

open ↗

Referência

CVE-2026-56121

CVE-2026-56121CRITICAL

Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization

48RISK

open ↗

Referência

CVE-2026-56111

CVE-2026-56111HIGH

Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler

41RISK

open ↗

Referência✓ VexDay Proof

adaptweb 0.9.2 - Local File Inclusion / SQL Injection

CVE-2009-2152—webappsphp

SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2025-32433

CVE-2025-32433CRITICALunder attack

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISK

open ↗

Referência

CVE-2026-7732

CVE-2026-7732MEDIUM

code-projects BloodBank Managing System request_blood.php unrestricted upload

33RISK

open ↗

Referência

WonderCMS 3.4.2 - Remote Code Execution (RCE)

CVE-2023-41425MEDIUMremotephp

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISK

open ↗

Referência

CVE-2022-43769

CVE-2022-43769HIGHunder attack

Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

100RISK

open ↗

Referência

CVE-2023-4174

CVE-2023-4174LOW

mooSocial mooStore cross site scripting

43RISK

open ↗

Referência

CVE-2019-18818

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISK

open ↗

Referência✓ VexDay Proof

Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion

CVE-2006-6711—webappsphp

PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2011-5257

CVE-2011-5257—

Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote att

23RISK

open ↗

Referência✓ VexDay Proof

PowerClan 1.14a - 'footer.inc.php' Remote File Inclusion

CVE-2006-6715—webappsphp

PHP remote file inclusion vulnerability in footer.inc.php in PowerClan 1.14a and earlier, when register_globals is enabl

23RISK

open ↗

Referência

CVE-2025-61884

CVE-2025-61884HIGHunder attackransomware

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions

100RISK

open ↗

Referência

CVE-2024-10914

CVE-2024-10914CRITICAL

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISK

open ↗

Referência

CVE-2019-9082

CVE-2019-9082HIGHunder attack

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public/

100RISK

open ↗

Referência

CVE-2023-27524

CVE-2023-27524HIGHunder attack

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

100RISK

open ↗

Referência

CVE-2023-27524

CVE-2023-27524HIGHunder attack

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

100RISK

open ↗

Referência✓ VexDay Proof

Uploader & Downloader 3.0 - 'id_user' SQL Injection

CVE-2006-6716—webappsphp

SQL injection vulnerability in administration/administre2.php in Eric GUILLAUME uploader&downloader 3 allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Bandwebsite 1.5 - 'LOGIN' Remote Add Admin

CVE-2006-6722—webappsphp

Bandwebsite (aka Bandsite portal system) 1.5 allows remote attackers to create administrative accounts via a direct requ

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - 'NetrWkstaUserEnum()' Remote Denial of Service

CVE-2006-6723—doswindows

The Workstation service in Microsoft Windows 2000 SP4 and XP SP2 allows remote attackers to cause a denial of service (m

35RISK

open ↗

Referência✓ VexDay Proof

BolinTech DreamFTP Server 1.0.2 - 'PORT' Remote Denial of Service

CVE-2006-6724—doswindows

BolinTech Dream FTP Server 1.02 allows remote authenticated users, including anonymous users, to cause a denial of servi

23RISK

open ↗

Referência✓ VexDay Proof

cwmVote 1.0 - 'archive.php' Remote File Inclusion

CVE-2006-6732—webappsphp

PHP remote file inclusion vulnerability in archive.php in cwmVote 1.0 allows remote attackers to execute arbitrary PHP c

23RISK

open ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISK

open ↗

Referência

CVE-2019-0230

CVE-2019-0230—

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

60RISK

open ↗

Referência✓ VexDay Proof

Paristemi 0.8.3b - 'buycd.php' Remote File Inclusion

CVE-2006-6739—webappsphp

PHP remote file inclusion vulnerability in buycd.php in Paristemi 0.8.3 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.