Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits

40,392CVEs with public exploitation

24,696lab-tested

All Referência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2017-17575

CVE-2017-17575—

FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.

23RISK

open ↗

Referência

CVE-2017-20259

CVE-2017-20259HIGH

Joomla OSDownloads 1.7.4 SQL Injection via item view

41RISK

open ↗

Referência✓ VexDay Proof

Libera CMS 1.12 - 'cookie' SQL Injection

CVE-2008-4700—webappsphp

SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remot

23RISK

open ↗

Referência

CVE-2026-8981

CVE-2026-8981LOW

Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML

28RISK

open ↗

Referência

CVE-2026-11585

CVE-2026-11585MEDIUM

CodeAstro Student Attendance Management System createClassArms.php sql injection

33RISK

open ↗

Referência

CVE-2009-4599

CVE-2009-4599—

Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers

23RISK

open ↗

Referência

CVE-2009-4600

CVE-2009-4600—

SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attacke

23RISK

open ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALunder attack

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALunder attack

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2026-7315

CVE-2026-7315MEDIUM

eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal

33RISK

open ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALunder attack

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2007-6515

CVE-2007-6515—

support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator charact

23RISK

open ↗

Referência

CVE-2009-3119

CVE-2009-3119—

SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attacke

23RISK

open ↗

Referência

TikiWiki Project < 1.9.9 - 'tiki-listmovies.php' Directory Traversal

CVE-2007-6528—webappsphp

Directory traversal vulnerability in tiki-listmovies.php in TikiWiki before 1.9.9 allows remote attackers to read arbitr

23RISK

open ↗

Referência

CVE-2016-3081

CVE-2016-3081HIGHunder attack

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a

100RISK

open ↗

Referência

CVE-2017-9756

CVE-2017-9756—

The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a d

23RISK

open ↗

Referência

CVE-2017-9811

CVE-2017-9811—

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maint

28RISK

open ↗

Referência

CVE-2026-49136

CVE-2026-49136HIGH

Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py

21RISK

open ↗

Referência

CVE-2026-43624

CVE-2026-43624HIGH

F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()

21RISK

open ↗

Referência

CVE-2026-43623

CVE-2026-43623HIGH

microtar 0.1.0 Stack-Based Buffer Overflow via raw_to_header()

21RISK

open ↗

Referência

CVE-2017-20289

CVE-2017-20289HIGH

Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

41RISK

open ↗

Referência

CVE-2026-16055

CVE-2026-16055HIGH

Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login

41RISK

open ↗

Referência

CVE-2017-17623

CVE-2017-17623—

Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.

23RISK

open ↗

Referência

CVE-2017-20289

CVE-2017-20289HIGH

Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

41RISK

open ↗

Referência

CVE-2021-26084

CVE-2021-26084CRITICALunder attackransomware

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

Referência

CVE-2017-20287

CVE-2017-20287HIGH

Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter

41RISK

open ↗

Referência

CVE-2026-111971

CVE-2026-111971MEDIUM

Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name

33RISK

open ↗

Referência

CVE-2010-4232

CVE-2010-4232—

The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera

23RISK

open ↗

Referência

CVE-2017-17623

CVE-2017-17623—

Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.

23RISK

open ↗

Referência

CVE-2026-109927

CVE-2026-109927HIGH

CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.