Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,560cataloged exploits

40,285CVEs with public exploitation

24,696lab-tested

All Referência 26,110Exploit-DB 24,488GitHub PoC 17,867VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,110 exploits

Referência✓ VexDay Proof

Madirish Webmail 2.0 - 'addressbook.php' Remote File Inclusion

CVE-2007-2826—webappsphp

PHP remote file inclusion vulnerability in lib/addressbook.php in Madirish Webmail 2.0 allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

WebChat 0.78 - 'login.php?rid' SQL Injection

CVE-2007-3534—webappsphp

SQL injection vulnerability in login.php in WebChat 0.78 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2022-36551

CVE-2022-36551—

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.

23RISK

open ↗

Referência

CVE-2016-3989

CVE-2016-3989—

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME

23RISK

open ↗

Referência

CVE-2026-18464

CVE-2026-18464HIGH

WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

41RISK

open ↗

Referência✓ VexDay Proof

PHP JOBWEBSITE PRO - 'JobSearch3.php' SQL Injection

CVE-2008-2914—webappsphp

SQL injection vulnerability in jobseekers/JobSearch3.php (aka the search module) in PHP JOBWEBSITE PRO allows remote att

23RISK

open ↗

Referência

CVE-2017-7462

CVE-2017-7462—

Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI scr

28RISK

open ↗

Referência

CVE-2010-0982

CVE-2010-0982—

Directory traversal vulnerability in the CARTwebERP (com_cartweberp) component 1.56.75 for Joomla! allows remote attacke

38RISK

open ↗

Referência

CVE-2020-25901

CVE-2020-25901—

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious we

23RISK

open ↗

Referência

CVE-2023-5360

CVE-2023-5360—

Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

60RISK

open ↗

Referência

CVE-2012-5326

CVE-2012-5326—

Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

Coppermine Photo Gallery 1.3.x - Blind SQL Injection

CVE-2007-1107—webappsphp

SQL injection vulnerability in thumbnails.php in Coppermine Photo Gallery (CPG) 1.3.x allows remote authenticated users

23RISK

open ↗

Referência

CVE-2014-8596

CVE-2014-8596—

Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2015-4062

CVE-2015-4062—

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RISK

open ↗

Referência

CVE-2017-18344

CVE-2017-18344—

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly

23RISK

open ↗

Referência

CVE-2017-3629

CVE-2017-3629—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t

38RISK

open ↗

Referência✓ VexDay Proof

WholeHogSoftware Password Protect - Authentication Bypass

CVE-2009-0459—webappsphp

Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remot

23RISK

open ↗

Referência

CVE-2017-3629

CVE-2017-3629—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t

38RISK

open ↗

Referência

CVE-2010-2459

CVE-2010-2459—

SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2015-4062

CVE-2015-4062—

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RISK

open ↗

Referência

CVE-2009-3754

CVE-2009-3754—

Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

Mx Module Smartor Album FAP 2.0 RC 1 - Remote File Inclusion

CVE-2007-2189—webappsphp

PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 mod

23RISK

open ↗

Referência✓ VexDay Proof

Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion

CVE-2007-2305—webappsphp

Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, a

23RISK

open ↗

Referência✓ VexDay Proof

QuickTicket 1.2 - 'qti_checkname.php' Local File Inclusion

CVE-2007-3547—webappsphp

Directory traversal vulnerability in qti_checkname.php in QuickTicket 1.2 allows remote attackers to include and execute

23RISK

open ↗

Referência✓ VexDay Proof

E-Smart Cart - 'productsofcat.asp' SQL Injection

CVE-2008-2917—webappsasp

SQL injection vulnerability in productsofcat.asp in E-SMART CART allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2014-0867

CVE-2014-0867—

rcore6/main/addcookie.jsp in RICOS in IBM Algo Credit Limits (aka ACLM) 4.5.0 through 4.7.0 before 4.7.0.03 FP5 in IBM A

23RISK

open ↗

Referência

CVE-2017-12950

CVE-2017-12950—

The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL p

23RISK

open ↗

Referência

CVE-2018-10900

CVE-2018-10900HIGH

Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attac

56RISK

open ↗

Referência

CVE-2021-24308

CVE-2021-24308—

LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile

23RISK

open ↗

Referência

CVE-2022-36804

CVE-2022-36804HIGHunder attack

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.