Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
25,557 exploits
Referência
CVE-2007-2821
CVE-2007-2821—
SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
The Recipe Script 5 - Authentication Bypass / Database Backup
CVE-2009-1662—webappsphp
Multiple SQL injection vulnerabilities in admin/login.php in Wright Way Services Recipe Script 5 allow remote attackers
23RISK
open ↗
Referência
CVE-2010-4793
CVE-2010-4793—
SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion
CVE-2007-5102—webappsphp
PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register_globals is enabled, allows
35RISK
open ↗
Referência
CVE-2010-4793
CVE-2010-4793—
SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
CA Internet Security Suite 2008 - 'SaveToFile()' File Corruption (PoC)
CVE-2008-2511—doswindows
Directory traversal vulnerability in the UmxEventCli.CachedAuditDataList.1 (aka UmxEventCliLib) ActiveX control in UmxEv
28RISK
open ↗
Referência
CVE-2012-5452
CVE-2012-5452—
Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
SCO UnixWare Reliant HA 1.1.4 - Local Privilege Escalation
CVE-2008-6558—localsco
Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local use
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Media Player - '.mid' Integer Overflow (PoC)
CVE-2009-1331—doswindows
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of ser
28RISK
open ↗
Referência✓ VexDay Proof
PAD Site Scripts 3.6 - Insecure Cookie Handling
CVE-2009-1739—webappsphp
PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including admi
23RISK
open ↗
Referência
CVE-2026-109392
CVE-2026-109392MEDIUM
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
33RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1749—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Flyspeck CMS 6.8 - Local/Remote File Inclusion / Change Add Admin
CVE-2009-1770—webappsphp
Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
BigACE 2.5 - SQL Injection
CVE-2009-1778—webappsphp
SQL injection vulnerability in the new user registration feature in BigACE CMS 2.5, when magic_quotes_gpc is disabled, a
23RISK
open ↗
Referência✓ VexDay Proof
IMGallery 2.5 - Multiple SQL Injections
CVE-2008-2337—webappsphp
Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Audioactive Player 1.93b - '.m3u' Local Buffer Overflow (SEH)
CVE-2009-1815—localwindows
Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via
23RISK
open ↗
Referência✓ VexDay Proof
Extreme phpBB 3.0.1 - 'functions.php' Remote File Inclusion
CVE-2007-1105—webappsphp
PHP remote file inclusion vulnerability in functions.php in Extreme phpBB (aka phpBB Extreme) 3.0.1 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting
CVE-2009-1820—webappsphp
Cross-site scripting (XSS) vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
DMXReady Registration Manager 1.1 - Database Disclosure
CVE-2009-1821—webappsasp
DMXReady Registration Manager 1.1 stores sensitive information under the web root with insufficient access control, whic
23RISK
open ↗
Referência
CVE-2010-4898
CVE-2010-4898—
SQL injection vulnerability in the Gantry (com_gantry) component 3.0.10 for Joomla! allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Zomplog 3.8.1 - Arbitrary File Upload
CVE-2007-5278—webappsphp
Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control,
23RISK
open ↗
Referência
CVE-2010-4915
CVE-2010-4915—
SQL injection vulnerability in index.cfm in ColdGen ColdBookmarks 1.22 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
LiveAlbum 0.9.0 - 'common.php' Remote File Inclusion
CVE-2007-5315—webappsphp
PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remot
35RISK
open ↗
Referência
CVE-2023-33592
CVE-2023-33592—
Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lf
23RISK
open ↗
Referência
CVE-2026-109391
CVE-2026-109391CRITICAL
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
48RISK
open ↗
Referência✓ VexDay Proof
PicoFlat CMS 0.4.14 - 'index.php' Remote File Inclusion
CVE-2007-5390—webappsphp
PHP remote file inclusion vulnerability in index.php in PicoFlat CMS 0.4.14 and earlier allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Contact Info 1.0 - SQL Injection
CVE-2008-5494—webappsphp
SQL injection vulnerability in the Contact Information Module (com_contactinfo) component 1.0 for Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
WEBBDOMAIN Quiz 1.02 - Authentication Bypass
CVE-2008-6626—webappsphp
SQL injection vulnerability in getin.php in WEBBDOMAIN Quiz 1.02 and earlier allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component ArtForms 2.1 b7 - Remote File Inclusion
CVE-2009-1822—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7 for Joomla
23RISK
open ↗
Referência✓ VexDay Proof
Winamp 5.55 - MAKI script Universal Integer Overflow
CVE-2009-1831—localwindows
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗
← previouspage 22 / 852next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.