Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência
CVE-2021-30147
CVE-2021-30147—
DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
23RISK
open ↗
Referência
CVE-2012-1669
CVE-2012-1669—
Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and exec
23RISK
open ↗
Referência
CVE-2026-9436
CVE-2026-9436CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection
48RISK
open ↗
Referência
CVE-2017-5473
CVE-2017-5473—
Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authenticati
23RISK
open ↗
Referência
CVE-2014-0984
CVE-2014-0984—
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation
23RISK
open ↗
Referência
CVE-2014-3080
CVE-2014-3080—
Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware
23RISK
open ↗
Referência✓ VexDay Proof
FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion
CVE-2007-1133—webappsphp
PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência
CVE-2014-5308
CVE-2014-5308—
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2018-8065
CVE-2018-8065—
An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access v
60RISK
open ↗
Referência
CVE-2017-0123
CVE-2017-0123—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2015-2166
CVE-2015-2166—
Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5
43RISK
open ↗
Referência
CVE-2026-85223
CVE-2026-85223CRITICAL
D-Link DNS-340L CGI dropbox.cgi os command injection
48RISK
open ↗
Referência✓ VexDay Proof
FlashBlog - 'articulo_id' SQL Injection
CVE-2008-2572—webappsphp
SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2011-1569
CVE-2011-1569—
download.aspx in Douran Portal 3.9.7.8 allows remote attackers to obtain source code of arbitrary files under the web ro
23RISK
open ↗
Referência
CVE-2014-5308
CVE-2014-5308—
Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2026-82624
CVE-2026-82624MEDIUM
code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure
33RISK
open ↗
Referência
CVE-2026-90511
CVE-2026-90511MEDIUM
GongShengyue OnlineBooks listSplit BooksServlet.java sql injection
33RISK
open ↗
Referência
CVE-2012-1669
CVE-2012-1669—
Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and exec
23RISK
open ↗
Referência
CVE-2005-0853
CVE-2005-0853—
betaparticle blog (bp blog) stores the database under the web root, which allows remote attackers to obtain sensitive in
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.04 - Blind SQL Injection
CVE-2008-4494—webappsphp
SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote at
23RISK
open ↗
Referência
CVE-2026-90508
CVE-2026-90508MEDIUM
Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization
33RISK
open ↗
Referência
CVE-2006-2226
CVE-2006-2226—
Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv
23RISK
open ↗
Referência
CVE-2012-5294
CVE-2012-5294—
SQL injection vulnerability in art_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2014-8653
CVE-2014-8653—
Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit
23RISK
open ↗
Referência
CVE-2014-9522
CVE-2014-9522—
Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component acctexp 0.12.x - Blind SQL Injection
CVE-2008-2632—webappsphp
SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attacker
23RISK
open ↗
Referência
CVE-2017-0126
CVE-2017-0126—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2019-6263
CVE-2019-6263—
An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allo
23RISK
open ↗
Referência
CVE-2014-10035
CVE-2014-10035—
Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrat
23RISK
open ↗
Referência
CVE-2014-10035
CVE-2014-10035—
Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrat
23RISK
open ↗
← previouspage 207 / 870next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.