Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,390cataloged exploits

40,212CVEs with public exploitation

24,696lab-tested

All Referência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,992Nuclei 4,547Metasploit 3,531✓ verified onlyrecent popular risk

26,070 exploits

Referência✓ VexDay Proof

Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (1)

CVE-2008-3250—webappsphp

SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2026-92810

CVE-2026-92810MEDIUM

PrestaShop blockwishlist through 3.0.2 Information Disclosure

33RISK

open ↗

Referência

CVE-2009-4721

CVE-2009-4721—

Multiple SQL injection vulnerabilities in Admin/index.asp in Andrews-Web (A-W) BannerAd 1.0 allow remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component MosReporter 0.9.3 - Remote File Inclusion

CVE-2006-6051—webappsphp

PHP remote file inclusion vulnerability in reporter.logic.php in the MosReporter (com_reporter) component for Mambo and

23RISK

open ↗

Referência

CVE-2010-4269

CVE-2010-4269—

SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2009-4724

CVE-2009-4724—

SQL injection vulnerability in shop.htm in PaymentProcessorScript.net PPScript allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2010-4269

CVE-2010-4269—

SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2012-4031

CVE-2012-4031—

Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attacke

50RISK

open ↗

Referência

CVE-2026-109165

CVE-2026-109165MEDIUM

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

33RISK

open ↗

Referência✓ VexDay Proof

e-Ark 1.0 - '/src/ark_inc.php' Remote File Inclusion

CVE-2006-6086—webappsphp

PHP remote file inclusion vulnerability in src/ark_inc.php in e-Ark 1.0 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência

CVE-2017-8678

CVE-2017-8678—

The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server

23RISK

open ↗

Referência

CVE-2017-8680

CVE-2017-8680—

The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server

23RISK

open ↗

Referência

CVE-2026-92809

CVE-2026-92809MEDIUM

PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

33RISK

open ↗

Referência

CVE-2026-108827

CVE-2026-108827LOW

Zen Cart Administrative Module Management general.php zen_call_function code injection

28RISK

open ↗

Referência

CVE-2006-6184

CVE-2006-6184—

Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote at

50RISK

open ↗

Referência

CVE-2010-4864

CVE-2010-4864—

SQL injection vulnerability in the Club Manager (com_clubmanager) component for Joomla! allows remote attackers to execu

23RISK

open ↗

Referência

CVE-2026-89299

CVE-2026-89299HIGH

WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter

41RISK

open ↗

Referência

CVE-2026-14689

CVE-2026-14689MEDIUM

CodeAstro Apartment Visitor Management System add-apartment.php sql injection

33RISK

open ↗

Referência

CVE-2026-14688

CVE-2026-14688MEDIUM

itsourcecode Online Hotel Management System login.php sql injection

33RISK

open ↗

Referência

CVE-2026-89213

CVE-2026-89213HIGH

Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter

41RISK

open ↗

Referência✓ VexDay Proof

OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH

CVE-2008-3280—remotelinux

It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Deb

23RISK

open ↗

Referência✓ VexDay Proof

Phorum 3.2.11 - 'common.php' Remote File Inclusion

CVE-2006-6550—webappsphp

PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2008-6740

CVE-2008-6740—

PHP remote file inclusion vulnerability in html/admin/modules/plugin_admin.php in HoMaP-CMS 0.1 allows remote attackers

23RISK

open ↗

Referência

CVE-2012-4057

CVE-2012-4057—

Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted

23RISK

open ↗

Referência

CVE-2026-14687

CVE-2026-14687MEDIUM

666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison

33RISK

open ↗

Referência

CVE-2026-89195

CVE-2026-89195HIGH

Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

41RISK

open ↗

Referência

CVE-2026-14692

CVE-2026-14692MEDIUM

SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php save_shop_type sql injection

33RISK

open ↗

Referência✓ VexDay Proof

mxBB Module newssuite 1.03 - Remote File Inclusion

CVE-2006-6553—webappsphp

PHP remote file inclusion vulnerability in includes/newssuite_constants.php in the NewsSuite 1.03 module for mxBB allows

23RISK

open ↗

Referência✓ VexDay Proof

Crob FTP Server 3.6.1 build 263 - 'LIST/NLST' Denial of Service

CVE-2006-6558—doswindows

Crob FTP Server 3.6.1 b.263 allows remote attackers to cause a denial of service via a long series of "?A" sequences in

23RISK

open ↗

Referência

CVE-2026-14691

CVE-2026-14691MEDIUM

SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.