Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

26,041 exploits

Referência

CVE-2026-109441

CVE-2026-109441MEDIUM

LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge

33RISK

open ↗

Referência

CVE-2010-5039

CVE-2010-5039—

SQL injection vulnerability in control/admin_login.php in ScriptsFeed Recipes Listing Portal 1.0 allows remote attackers

23RISK

open ↗

Referência

CVE-2010-5056

CVE-2010-5056—

SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Maran PHP Forum - 'forum_write.php' Remote Code Execution

CVE-2007-2182—webappsphp

Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execu

23RISK

open ↗

Referência

CVE-2018-8532

CVE-2018-8532—

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious

28RISK

open ↗

Referência

CVE-2015-3313

CVE-2015-3313—

SQL injection vulnerability in WordPress Community Events plugin before 1.4.

23RISK

open ↗

Referência✓ VexDay Proof

SysInfo 1.21 - 'sysinfo.cgi' Remote Command Execution

CVE-2006-1831—webappscgi

Direct static code injection vulnerability in sysinfo.cgi in sysinfo 1.21 and possibly other versions before 2.25 allows

23RISK

open ↗

Referência✓ VexDay Proof

ASPapp Knowledge Base - 'CatId' SQL Injection (1)

CVE-2008-1430—webappsasp

SQL injection vulnerability in links.asp in ASPapp allows remote attackers to execute arbitrary SQL commands via the Cat

23RISK

open ↗

Referência

CVE-2026-108816

CVE-2026-108816MEDIUM

agno-agi agno PythonTools python.py run_python_code code injection

33RISK

open ↗

Referência

CVE-2026-85677

CVE-2026-85677HIGH

Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content

41RISK

open ↗

Referência

CVE-2010-1737

CVE-2010-1737—

PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disable

23RISK

open ↗

Referência

CVE-2010-5236

CVE-2010-5236—

Untrusted search path vulnerability in Roxio Easy Media Creator Home 9.0.136 allows local users to gain privileges via a

23RISK

open ↗

Referência

CVE-2026-74925

CVE-2026-74925HIGH

MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

41RISK

open ↗

Referência

CVE-2006-2152

CVE-2006-2152—

PHP remote file inclusion vulnerability in admin/addentry.php in phpBB Advanced Guestbook 2.4.0 and earlier, when regist

23RISK

open ↗

Referência✓ VexDay Proof

Newxooper-PHP 0.9.1 - 'mapage.php' Remote File Inclusion

CVE-2006-6711—webappsphp

PHP remote file inclusion vulnerability in compteur/mapage.php in Newxooper 0.9.1 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

forum livre 1.0 - SQL Injection / Cross-Site Scripting

CVE-2007-0589—webappsasp

SQL injection vulnerability in Forum Livre 1.0 allows remote attackers to execute arbitrary SQL commands via the user pa

23RISK

open ↗

Referência✓ VexDay Proof

PHPSiteBackup 0.1 - 'pcltar.lib.php' Remote File Inclusion

CVE-2007-2199—webappsphp

PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vi

35RISK

open ↗

Referência

CVE-2017-14322

CVE-2017-14322—

The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior

35RISK

open ↗

Referência

CVE-2026-13725

CVE-2026-13725HIGH

Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax

41RISK

open ↗

Referência

CVE-2013-6025

CVE-2013-6025—

The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to re

23RISK

open ↗

Referência

CVE-2017-2446

CVE-2017-2446—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef

23RISK

open ↗

Referência

CVE-2014-2021

CVE-2014-2021—

Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 a

23RISK

open ↗

Referência

CVE-2019-17080

CVE-2019-17080—

mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by a

23RISK

open ↗

Referência

CVE-2017-2446

CVE-2017-2446—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef

23RISK

open ↗

Referência✓ VexDay Proof

OneCMS 2.5 - Blind SQL Injection

CVE-2008-6652—webappsphp

SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the s

23RISK

open ↗

Referência

CVE-2026-14862

CVE-2026-14862LOW

Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization

28RISK

open ↗

Referência

CVE-2010-1858

CVE-2010-1858—

Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote atta

43RISK

open ↗

Referência

CVE-2010-4356

CVE-2010-4356—

SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2010-4356

CVE-2010-4356—

SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2009-3062

CVE-2009-3062—

SQL injection vulnerability in message_box.php in OSI Codes PHP Live! 3.3 allows remote attackers to execute arbitrary S

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.