Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits

40,037CVEs with public exploitation

24,696lab-tested

All Referência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecent popular risk

25,887 exploits

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - SQL Injection

CVE-2008-6788—webappsphp

SQL injection vulnerability in MindDezign Photo Gallery 2.2, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência

CVE-2022-4297

CVE-2022-4297CRITICAL

WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi

48RISK

open ↗

Referência✓ VexDay Proof

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin

CVE-2008-6789—webappsphp

SQL injection vulnerability in MindDezign Photo Gallery 2.2 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2022-4297

CVE-2022-4297CRITICAL

WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2017-17640

CVE-2017-17640—

Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country pa

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component 'com_colophon' 1.2 - Remote File Inclusion

CVE-2006-3969—webappsphp

PHP remote file inclusion vulnerability in administrator/components/com_colophon/admin.colophon.php in Colophon 1.2 and

23RISK

open ↗

Referência

CVE-2018-19126

CVE-2018-19126—

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file u

28RISK

open ↗

Referência✓ VexDay Proof

Mambo Component MGM 0.95r2 - Remote File Inclusion

CVE-2006-3980—webappsphp

PHP remote file inclusion vulnerability in administrator/components/com_mgm/help.mgm.php in Mambo Gallery Manager (MGM)

23RISK

open ↗

Referência✓ VexDay Proof

Site@School 2.4.02 - Arbitrary File Upload

CVE-2006-4922—webappsphp

Unrestricted file upload vulnerability in starnet/editors/htmlarea/popups/images.php in Site@School (S@S) 2.4.02 and ear

23RISK

open ↗

Referência✓ VexDay Proof

ProgSys 0.156 - 'RR.php' Remote File Inclusion

CVE-2006-4944—webappsphp

PHP remote file inclusion vulnerability in includes/pear/Net/DNS/RR.php in ProgSys 0.151 and earlier allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Galeria Zdjec 3.0 - 'zd_numer.php' Local File Inclusion

CVE-2007-0637—webappsphp

Directory traversal vulnerability in zd_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include an

23RISK

open ↗

Referência

CVE-2020-12608

CVE-2020-12608—

An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Moni

28RISK

open ↗

Referência

CVE-2017-8550

CVE-2017-8550—

A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted

28RISK

open ↗

Referência

CVE-2018-12596

CVE-2018-12596—

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote at

28RISK

open ↗

Referência

CVE-2017-0111

CVE-2017-0111—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência

CVE-2020-2038

CVE-2020-2038HIGH

PAN-OS: OS command injection vulnerability in the management web interface

78RISK

open ↗

Referência✓ VexDay Proof

Vibro-School-CMS - 'nID' SQL Injection

CVE-2008-6795—webappsphp

SQL injection vulnerability in view_news.php in nicLOR Vibro-School-CMS allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

MyReview 1.9.4 - 'email' SQL Injection / Code Execution

CVE-2006-4957—webappsphp

SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2015-8636

CVE-2015-8636—

Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on

28RISK

open ↗

Referência

CVE-2016-3987

CVE-2016-3987—

The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url para

28RISK

open ↗

Referência✓ VexDay Proof

ASPSiteWare RealtyListing 1.0/2.0 - SQL Injection

CVE-2008-5772—webappsasp

Multiple SQL injection vulnerabilities in ASPSiteWare RealtyListings 1.0 and 2.0 allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2026-110712

CVE-2026-110712HIGH

libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

41RISK

open ↗

Referência

CVE-2017-3077

CVE-2017-3077—

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the PNG image

28RISK

open ↗

Referência

CVE-2022-44149

CVE-2022-44149HIGH

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by

53RISK

open ↗

Referência✓ VexDay Proof

Booking Centre 2.01 - Authentication Bypass

CVE-2008-6810—webappsphp

Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Grou

23RISK

open ↗

Referência

CVE-2009-4208

CVE-2009-4208—

SQL injection vulnerability in the os_news module in Open-school (OS) 1.0 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2015-8770

CVE-2015-8770—

Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before

28RISK

open ↗

Referência✓ VexDay Proof

PHPwebnews 0.2 MySQL Edition - 'det' SQL Injection

CVE-2008-6812—webappsphp

SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2026-13527

CVE-2026-13527MEDIUM

SourceCodester Class and Exam Timetabling System preview4.php sql injection

33RISK

open ↗

Referência

CVE-2010-1717

CVE-2010-1717—

Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attacke

43RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.