Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,035cataloged exploits

39,531CVEs with public exploitation

24,695lab-tested

All Referência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecent popular risk

25,447 exploits

Referência✓ VexDay Proof

Sepcity Classified - 'ID' SQL Injection

CVE-2008-6150—webappsasp

SQL injection vulnerability in classdis.asp in SepCity Classified Ads allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2026-19923

CVE-2026-19923MEDIUM

code-projects Online Shopping System checkout_process.php sql injection

33RISK

open ↗

Referência

CVE-2026-19922

CVE-2026-19922MEDIUM

code-projects Online Shopping System checkout.php cross site scripting

33RISK

open ↗

Referência

CVE-2010-4401

CVE-2010-4401—

languages.inc.php in DynPG CMS 4.2.0 allows remote attackers to obtain sensitive information via a direct request, which

23RISK

open ↗

Referência

CVE-2026-19921

CVE-2026-19921MEDIUM

code-projects Online Shopping System homeaction.php sql injection

33RISK

open ↗

Referência

CVE-2018-11409

CVE-2018-11409—

Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json

60RISK

open ↗

Referência✓ VexDay Proof

Cadre PHP Framework - Remote File Inclusion

CVE-2007-0677—webappsphp

PHP remote file inclusion vulnerability in fw/class.Quick_Config_Browser.php in Cadre PHP Framework 20020724 allows remo

23RISK

open ↗

Referência✓ VexDay Proof

miniPortail 2.2 - Cross-Site Scripting / Local File Inclusion

CVE-2008-6168—webappsphp

Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection

CVE-2008-6180—webappsphp

SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows

23RISK

open ↗

Referência✓ VexDay Proof

MyBB Plugin Custom Pages 1.0 - SQL Injection

CVE-2008-6198—webappsphp

SQL injection vulnerability in pages.php in Custom Pages 1.0 plugin for MyBulletinBoard (MyBB) allows remote attackers t

23RISK

open ↗

Referência

CVE-2010-0375

CVE-2010-0375—

SQL injection vulnerability in product_list.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

SazCart 1.5 - 'cart.php' Remote File Inclusion

CVE-2006-5727—webappsphp

PHP remote file inclusion vulnerability in admin/controls/cart.php in sazcart 1.5 allows remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2026-32834

CVE-2026-32834HIGH

Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code Scanning

41RISK

open ↗

Referência

CVE-2026-7744

CVE-2026-7744MEDIUM

CodeAstro Online Classroom addnewstudent sql injection

33RISK

open ↗

Referência

CVE-2026-9702

CVE-2026-9702HIGH

InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking

41RISK

open ↗

Referência

CVE-2023-0961

CVE-2023-0961MEDIUM

SourceCodester Music Gallery Site GET Request view_music_details.php sql injection

33RISK

open ↗

Referência

CVE-2010-4609

CVE-2010-4609—

SQL injection vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

RealVNC Windows Client 4.1.2 - Remote Denial of Service Crash (PoC)

CVE-2008-3493—doswindows

vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application cras

23RISK

open ↗

Referência✓ VexDay Proof

Categories hierarchy phpBB Mod 2.1.2 - 'phpbb_root_path' Remote File Inclusion

CVE-2007-0809—webappsphp

PHP remote file inclusion vulnerability in includes/class_template.php in Categories hierarchy (aka CH or mod-CH) 2.1.2

23RISK

open ↗

Referência✓ VexDay Proof

CA BrightStor ARCserve 11.5.2.0 - 'catirpc.dll' RPC Server Denial of Service

CVE-2007-0816—doswindows

The RPC Server service (catirpc.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 SP2 and earlie

28RISK

open ↗

Referência✓ VexDay Proof

MyPHP CMS 0.3.1 - 'pid' SQL Injection

CVE-2008-3497—webappsphp

SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

eDContainer 2.22 - Local File Inclusion

CVE-2008-5818—webappsphp

Directory traversal vulnerability in index.php in eDreamers eDContainer 2.22, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência✓ VexDay Proof

Dream4 Koobi 4.4/5.4 - gallery SQL Injection

CVE-2008-6210—webappsphp

SQL injection vulnerability in index.php in dream4 Koobi 4.4 and 5.4 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

CVE-2020-14883

CVE-2020-14883HIGHunder attack

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISK

open ↗

Referência

CVE-2026-18976

CVE-2026-18976MEDIUM

NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

33RISK

open ↗

Referência

CVE-2010-4631

CVE-2010-4631—

Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2026-19904

CVE-2026-19904MEDIUM

SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting

33RISK

open ↗

Referência

CVE-2026-18974

CVE-2026-18974MEDIUM

heshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosure

33RISK

open ↗

Referência✓ VexDay Proof

PixelPost 1.7 - Blind SQL Injection

CVE-2008-0358—webappsphp

SQL injection vulnerability in index.php in Pixelpost 1.7 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

eXV2 Module Viso 2.0.4.3 - 'kid' SQL Injection

CVE-2008-1404—webappsphp

SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attacke

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.