Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência✓ VexDay Proof
Maran PHP Forum - 'forum_write.php' Remote Code Execution
Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execu
23RISK
open ↗Referência✓ VexDay Proof
Zenturi NixonMyPrograms Class 'sasatl.dll 1.5.0.531' - Remote Buffer Overflow
Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChec
23RISK
open ↗Referência✓ VexDay Proof
Drupal 5.2 - PHP Zend Hash ation Vector
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value m
23RISK
open ↗Referência✓ VexDay Proof
jspwiki 2.4.104/2.5.139 - Multiple Vulnerabilities
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbi
23RISK
open ↗Referência✓ VexDay Proof
ACG-PTP 1.0.6 - 'adid' SQL Injection
SQL injection vulnerability in index.php in ACG-PTP 1.0.6 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Referência
CVE-2020-8777
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo,
23RISK
open ↗Referência
CVE-2026-66751
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
33RISK
open ↗Referência
CVE-2014-3225
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated us
23RISK
open ↗Referência
CVE-2013-4098
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via
23RISK
open ↗Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Referência
CVE-2012-5347
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter
23RISK
open ↗Referência
CVE-2018-1002000
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require ad
23RISK
open ↗Referência✓ VexDay Proof
PrecisionID Barcode ActiveX 1.9 - Arbitrary File Overwrite
The PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll, when Internet Explorer 6 is used, allows remote
23RISK
open ↗Referência
CVE-2023-1826
SourceCodester Online Computer and Laptop Store index.php unrestricted upload
33RISK
open ↗Referência
CVE-2018-17784
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthentic
23RISK
open ↗Referência
CVE-2014-3247
Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web scr
23RISK
open ↗Referência✓ VexDay Proof
Natterchat 1.1 - Remote Authentication Bypass
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete room
23RISK
open ↗Referência
CVE-2013-5672
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗Referência
CVE-2013-5672
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗Referência
CVE-2018-8208
An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual regis
23RISK
open ↗Referência
CVE-2026-6113
Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection
48RISK
open ↗Referência
CVE-2026-6112
Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection
48RISK
open ↗Referência✓ VexDay Proof
OTSCMS 2.1.3 - Multiple Remote File Inclusions
PHP remote file inclusion vulnerability in OTSCMS/OTSCMS.php in Open Tibia Server Content Management System (OTSCMS) 1.3
23RISK
open ↗Referência✓ VexDay Proof
PHPPeanuts 1.3 Beta - 'Inspect.php' Remote File Inclusion
PHP remote file inclusion vulnerability in pntUnit/Inspect.php in phpPeanuts 1.1 and earlier allows remote attackers to
23RISK
open ↗Referência
CVE-2011-5166
Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string
23RISK
open ↗Referência✓ VexDay Proof
MDForum 2.0.1 - 'PNSVlang' Remote Code Execution
Directory traversal vulnerability in includes/search/search_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic_
23RISK
open ↗Referência
CVE-2011-5170
Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code vi
50RISK
open ↗Referência✓ VexDay Proof
pragmaMX Module Landkarten 2.1 (Windows) - Local File Inclusion
Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to inclu
23RISK
open ↗Referência✓ VexDay Proof
phpAddressBook 2.11 - Multiple Local File Inclusions
Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and e
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.