Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits

40,392CVEs with public exploitation

24,696lab-tested

All Referência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2026-84111

CVE-2026-84111MEDIUM

Chanjet CRM jxf_dump_table.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

myPHPCalendar 10192000b - 'cal_dir' Remote File Inclusion

CVE-2006-6812—webappsphp

Multiple PHP remote file inclusion vulnerabilities in myPHPCalendar 10.1 allow remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência

CVE-2013-2594

CVE-2013-2594—

SQL injection vulnerability in reports/calldiary.php in Hornbill Supportworks ITSM 1.0.0 through 3.4.14 allows remote at

23RISK

open ↗

Referência

CVE-2015-5075

CVE-2015-5075—

Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authe

23RISK

open ↗

Referência✓ VexDay Proof

PHP FirstPost 0.1 - 'block.php?Include' Remote File Inclusion

CVE-2007-2665—webappsphp

PHP remote file inclusion vulnerability in block.php in PhpFirstPost 0.1 allows remote attackers to execute arbitrary PH

23RISK

open ↗

Referência

CVE-2010-1350

CVE-2010-1350—

SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers

23RISK

open ↗

Referência

CVE-2010-1467

CVE-2010-1467—

Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

minimal Gallery 0.8 - Remote File Disclosure

CVE-2008-0259—webappsphp

Multiple directory traversal vulnerabilities in _mg/php/mg_thumbs.php in minimal Gallery 0.8 allow remote attackers to r

23RISK

open ↗

Referência✓ VexDay Proof

Netartmedia Cars Portal 2.0 - SQL Injection

CVE-2008-5310—webappsphp

SQL injection vulnerability in image.php in NetArt Media Car Portal 2.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

ASP Download 1.03 - Arbitrary Change Administrator Account

CVE-2008-6739—webappsasp

Todd Woolums ASP Download management script 1.03 does not require authentication for setupdownload.asp, which allows rem

23RISK

open ↗

Referência✓ VexDay Proof

S-CMS 1.1 Stable - 'page' Local File Inclusion

CVE-2009-1502—webappsphp

Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and exe

23RISK

open ↗

Referência

CVE-2009-4670

CVE-2009-4670—

admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arb

23RISK

open ↗

Referência

CVE-2009-4801

CVE-2009-4801—

EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via re

23RISK

open ↗

Referência

CVE-2024-36840

CVE-2024-36840CRITICAL

SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a

48RISK

open ↗

Referência

CVE-2024-36840

CVE-2024-36840CRITICAL

SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code a

48RISK

open ↗

Referência

CVE-2026-82669

CVE-2026-82669MEDIUM

klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

33RISK

open ↗

Referência

CVE-2023-42628

CVE-2023-42628CRITICAL

Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay

48RISK

open ↗

Referência

CVE-2023-42629

CVE-2023-42629CRITICAL

Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87,

48RISK

open ↗

Referência

CVE-2015-5591

CVE-2015-5591—

SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands.

23RISK

open ↗

Referência

CVE-2009-4433

CVE-2009-4433—

Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to injec

23RISK

open ↗

Referência

CVE-2011-5222

CVE-2011-5222—

SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execu

23RISK

open ↗

Referência

CVE-2013-3536

CVE-2013-3536—

SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea

23RISK

open ↗

Referência

CVE-2017-16567

CVE-2017-16567—

Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. T

23RISK

open ↗

Referência

CVE-2013-3536

CVE-2013-3536—

SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea

23RISK

open ↗

Referência

CVE-2014-3934

CVE-2014-3934—

SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2024-25414

CVE-2024-25414CRITICAL

An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code vi

48RISK

open ↗

Referência

CVE-2018-10313

CVE-2018-10313—

WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set

23RISK

open ↗

Referência

CVE-2026-96895

CVE-2026-96895MEDIUM

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

33RISK

open ↗

Referência

CVE-2026-82619

CVE-2026-82619MEDIUM

Systerel S2OPC subscription_mgr.c use after free

33RISK

open ↗

Referência

CVE-2026-82593

CVE-2026-82593CRITICAL

D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.