Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits

40,286CVEs with public exploitation

24,696lab-tested

All Referência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,110 exploits

Referência✓ VexDay Proof

Pet Grooming Management System 2.0 - Arbitrary Add Admin

CVE-2008-2294—webappsphp

Pet Grooming Management System 2.0 allows remote attackers to gain privileges via a direct request to useradded.php with

23RISK

open ↗

Referência✓ VexDay Proof

Pooya Site Builder (PSB) 6.0 - Multiple SQL Injections

CVE-2008-2753—webappsphp

Multiple SQL injection vulnerabilities in Pooya Site Builder (PSB) 6.0 allow remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

LokiCMS 0.3.3 - Arbitrary File Delete

CVE-2008-4913—webappsphp

Directory traversal vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to delete arbitrary

23RISK

open ↗

Referência

CVE-2008-5180

CVE-2008-5180MEDIUM

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of ser

45RISK

open ↗

Referência

CVE-2009-4807

CVE-2009-4807—

Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2009-4834

CVE-2009-4834—

lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibl

23RISK

open ↗

Referência

CVE-2009-4836

CVE-2009-4836—

Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2026-19348

CVE-2026-19348CRITICAL

Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection

48RISK

open ↗

Referência

CVE-2026-90814

CVE-2026-90814MEDIUM

cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery

33RISK

open ↗

Referência

CVE-2024-23897

CVE-2024-23897CRITICALunder attackransomware

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

open ↗

Referência

CVE-2026-90813

CVE-2026-90813MEDIUM

cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

33RISK

open ↗

Referência

CVE-2026-19347

CVE-2026-19347MEDIUM

itsourcecode Hospital Management System viewdoctor.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

ScriptMagix Recipes 2.0 - 'index.php?catid' SQL Injection

CVE-2007-1617—webappsphp

SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Active PHP Bookmark Notes 0.2.5 - Remote File Inclusion

CVE-2007-1621—webappsphp

PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allow

23RISK

open ↗

Referência✓ VexDay Proof

Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion

CVE-2007-4641—webappsphp

Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex

23RISK

open ↗

Referência✓ VexDay Proof

falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting

CVE-2007-6488—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2015-2843

CVE-2015-2843—

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute

50RISK

open ↗

Referência

CVE-2015-5531

CVE-2015-5531—

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp

60RISK

open ↗

Referência✓ VexDay Proof

Basic-CMS - SQL Injection

CVE-2008-2789—webappsphp

SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi

43RISK

open ↗

Referência✓ VexDay Proof

Comparison Engine Power 1.0 - Blind SQL Injection

CVE-2008-2791—webappsphp

SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote

23RISK

open ↗

Referência✓ VexDay Proof

X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion

CVE-2008-4718—webappsphp

Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an

23RISK

open ↗

Referência✓ VexDay Proof

Apple iTunes 8.1.1 - 'ITMS' Multiple Protocol Handler Buffer Overflow (Metasploit)

CVE-2009-0950—remoteosx

Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni

43RISK

open ↗

Referência

CVE-2018-12897

CVE-2018-12897—

SolarWinds DameWare Mini Remote Control before 12.1 has a Buffer Overflow.

23RISK

open ↗

Referência

CVE-2013-2594

CVE-2013-2594—

SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote at

23RISK

open ↗

Referência

CVE-2019-0881

CVE-2019-0881—

An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows

23RISK

open ↗

Referência

CVE-2014-9236

CVE-2014-9236—

Cross-site scripting (XSS) vulnerability in php/edit_photos.php in Zoph (aka Zoph Organizes Photos) 0.9.1 and earlier al

23RISK

open ↗

Referência

CVE-2026-90792

CVE-2026-90792MEDIUM

GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference

33RISK

open ↗

Referência

CVE-2016-4108

CVE-2016-4108—

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof

35RISK

open ↗

Referência

CVE-2016-6851

CVE-2016-6851—

An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX G

23RISK

open ↗

Referência✓ VexDay Proof

CCleague Pro 1.0.1RC1 - 'cookie' Remote Code Execution

CVE-2006-4721—webappsphp

Directory traversal vulnerability in admin.php in CCleague Pro Sports CMS 1.0.1 RC1 allows remote attackers to read and

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.