Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência✓ VexDay Proof
KwsPHP 1.3.456 Module Galerie - 'id_gal' SQL Injection
CVE-2008-6197—webappsphp
SQL injection vulnerability in index.php in the galerie module for KwsPHP 1.3.456 allows remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
2532/Gigs 1.2.2 - Arbitrary Database Backup/Download
CVE-2008-6199—webappsphp
2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via
23RISK
open ↗
Referência✓ VexDay Proof
FretsWeb 1.2 - Multiple Local File Inclusions
CVE-2009-2109—webappsphp
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via director
23RISK
open ↗
Referência✓ VexDay Proof
PHPFK 7.03 - 'page_bottom.php' Local File Inclusion
CVE-2009-2112—webappsphp
Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execut
23RISK
open ↗
Referência✓ VexDay Proof
TekBase All-in-One 3.1 - Multiple SQL Injections
CVE-2009-2120—webappsphp
Multiple SQL injection vulnerabilities in TekBase All-in-One 3.1 allow remote authenticated users to execute arbitrary S
23RISK
open ↗
Referência
CVE-2010-2334
CVE-2010-2334—
Directory traversal vulnerability in themes/default/download.php in Yamamah Photo Gallery 1.00, as distributed before 20
23RISK
open ↗
Referência✓ VexDay Proof
P-Book 1.17 - 'pb_lang' Remote File Inclusion
CVE-2006-5667—webappsphp
Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
ASPilot Pilot Cart 7.3 - 'article' SQL Injection
CVE-2008-2688—webappsasp
SQL injection vulnerability in pilot.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2021-42237
CVE-2021-42237CRITICALunder attackransomware
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it
100RISK
open ↗
Referência
CVE-2016-3115
CVE-2016-3115MEDIUM
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
45RISK
open ↗
Referência✓ VexDay Proof
MyBloggie 2.1.6 - Multiple SQL Injections
CVE-2008-3080—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to per
23RISK
open ↗
Referência✓ VexDay Proof
Harlandscripts drinks - 'recid' SQL Injection
CVE-2008-6233—webappsphp
SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption
CVE-2009-2176—webappsphp
Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, al
23RISK
open ↗
Referência✓ VexDay Proof
Active NewsLetter 4.3 - Authentication Bypass
CVE-2008-6286—webappsasp
Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption
CVE-2009-2177—webappsphp
code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote attackers to con
23RISK
open ↗
Referência✓ VexDay Proof
phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection
CVE-2009-2179—webappsphp
SQL injection vulnerability in search.php in phpDatingClub 3.7 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-109115
CVE-2026-109115MEDIUM
AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection
33RISK
open ↗
Referência
CVE-2026-109114
CVE-2026-109114MEDIUM
AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication
33RISK
open ↗
Referência
CVE-2009-4627
CVE-2009-4627—
Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attacke
23RISK
open ↗
Referência
CVE-2026-13169
CVE-2026-13169HIGH
Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
41RISK
open ↗
Referência
CVE-2026-76003
CVE-2026-76003CRITICAL
UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
48RISK
open ↗
Referência
CVE-2026-93975
CVE-2026-93975MEDIUM
code-projects Assessment Management User Editing edit-user.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
PHPWebThings 1.4 - 'msg'/'forum' SQL Injection
CVE-2005-4218—webappsphp
SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2022-30333
CVE-2022-30333CRITICALunder attackransomware
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
100RISK
open ↗
Referência
CVE-2026-82842
CVE-2026-82842HIGH
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
41RISK
open ↗
Referência✓ VexDay Proof
Rama CMS 0.68 - Cookie: lang Local File Inclusion
CVE-2006-5894—webappsphp
Directory traversal vulnerability in lang.php in Rama CMS 0.68 and earlier, when register_globals is enabled, allows rem
23RISK
open ↗
Referência
CVE-2026-12375
CVE-2026-12375CRITICAL
Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência✓ VexDay Proof
shibby shop 2.2 - Multiple Vulnerabilities
CVE-2008-2873—webappsphp
sHibby sHop 2.2 and earlier stores sensitive information under the web root with insufficient access control, which allo
23RISK
open ↗
Referência
CVE-2026-109180
CVE-2026-109180MEDIUM
jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
33RISK
open ↗
Referência
CVE-2026-15105
CVE-2026-15105MEDIUM
davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write
33RISK
open ↗
← previouspage 247 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.