Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência✓ VexDay Proof
ProQuiz 1.0 - Authentication Bypass
CVE-2008-6312—webappsphp
SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência
CVE-2015-7347
CVE-2015-7347—
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
23RISK
open ↗
Referência
CVE-2011-5262
CVE-2011-5262—
SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2026-118585
CVE-2026-118585MEDIUM
configuroweb inventariobasico Add Product addlist.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-118579
CVE-2026-118579CRITICAL
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
48RISK
open ↗
Referência
CVE-2026-115223
CVE-2026-115223MEDIUM
Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
33RISK
open ↗
Referência
CVE-2026-110508
CVE-2026-110508MEDIUM
Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
33RISK
open ↗
Referência
CVE-2026-106648
CVE-2026-106648MEDIUM
Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
33RISK
open ↗
Referência
CVE-2026-67207
CVE-2026-67207HIGH
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
41RISK
open ↗
Referência✓ VexDay Proof
Social Engine 3.06 - 'category_id' SQL Injection
CVE-2009-0400—webappsphp
SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
Dokuwiki 2009-02-14 - Temporary/Remote File Inclusion
CVE-2009-1960—webappsphp
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote att
28RISK
open ↗
Referência
CVE-2010-3461
CVE-2010-3461—
SQL injection vulnerability in the Publisher module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2010-5026
CVE-2010-5026—
SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2011-4570
CVE-2011-4570—
SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla
23RISK
open ↗
Referência
CVE-2010-5026
CVE-2010-5026—
SQL injection vulnerability in winners.php in Science Fair In A Box (SFIAB) 2.0.6 and 2.2.0 allows remote attackers to e
23RISK
open ↗
Referência
CVE-2012-5288
CVE-2012-5288—
SQL injection vulnerability in page.php in phpMyDirectory 1.3.3 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2012-0913
CVE-2012-0913—
SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2026-14840
CVE-2026-14840MEDIUM
YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
33RISK
open ↗
Referência
CVE-2012-0935
CVE-2012-0935—
SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2010-5083
CVE-2010-5083—
SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2024-22901
CVE-2024-22901CRITICAL
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
48RISK
open ↗
Referência
CVE-2011-4672
CVE-2011-4672—
Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
CVE-2025-25257CRITICALunder attackwebappsmultiple
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
Referência
CVE-2017-13795
CVE-2017-13795—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2026-66748
CVE-2026-66748HIGH
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
41RISK
open ↗
Referência
CVE-2025-15047
CVE-2025-15047CRITICAL
Tenda WH450 HTTP Request PPTPDClient stack-based overflow
48RISK
open ↗
Referência
CVE-2025-15047
CVE-2025-15047CRITICAL
Tenda WH450 HTTP Request PPTPDClient stack-based overflow
48RISK
open ↗
Referência
CVE-2023-0830
CVE-2023-0830MEDIUM
EasyNAS backup.pl system os command injection
38RISK
open ↗
Referência
CVE-2026-103330
CVE-2026-103330MEDIUM
Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
33RISK
open ↗
Referência
CVE-2026-103313
CVE-2026-103313MEDIUM
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
33RISK
open ↗
← previouspage 296 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.