Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,150 exploits
Referência
CVE-2026-82696
itsourcecode Sales and Inventory System inv_searchfrm.php sql injection
33RISK
open ↗Referência
CVE-2020-0618
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RISK
open ↗Referência
Joomla! Component JEXTN Reverse Auction 3.1.0 - SQL Injection
SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
23RISK
open ↗Referência✓ VexDay Proof
Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/common.inc.php in Epistemon 1.0 allows remote attackers to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
Somery 0.4.6 - 'skin_dir' Remote File Inclusion
PHP remote file inclusion vulnerability in install.php in Somery 0.4.6 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência
CVE-2026-15381
WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
28RISK
open ↗Referência
CVE-2020-0618
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RISK
open ↗Referência
CVE-2026-13392
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
41RISK
open ↗Referência✓ VexDay Proof
DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection
SQL injection vulnerability in viewitem.php in DL PayCart 1.01 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion
PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PN
23RISK
open ↗Referência
CVE-2026-16569
ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update
33RISK
open ↗Referência
CVE-2026-16568
ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR
33RISK
open ↗Referência✓ VexDay Proof
phpBB Links MOD 1.2.2 - SQL Injection
SQL injection vulnerability in links.php in the Links MOD 1.2.2 and earlier for phpBB 2.0.22 and earlier allows remote a
23RISK
open ↗Referência
CVE-2018-7312
SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.
23RISK
open ↗Referência
CVE-2018-12094
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arb
23RISK
open ↗Referência✓ VexDay Proof
Snitz Forums 2000 3.1 SR4 - 'pop_profile.asp' SQL Injection
SQL injection vulnerability in pop_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary
23RISK
open ↗Referência
GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution
Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .green
38RISK
open ↗Referência✓ VexDay Proof
News Rover 12.1 Rev 1 - Stack Overflow (1)
Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute ar
23RISK
open ↗Referência
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
33RISK
open ↗Referência
CVE-2017-6190
Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows
28RISK
open ↗Referência
CVE-2017-6361
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
35RISK
open ↗Referência
CVE-2026-15248
Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR
33RISK
open ↗Referência
CVE-2018-7448
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote
28RISK
open ↗Referência
CVE-2002-1230
NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute
23RISK
open ↗Referência✓ VexDay Proof
WebED 0.8999a - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers
35RISK
open ↗Referência
CVE-2017-8917
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.