Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2017-11165

CVE-2017-11165—

dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a d

50RISK

open ↗

Referência

CVE-2026-86839

CVE-2026-86839LOW

Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

28RISK

open ↗

Referência

CVE-2026-81655

CVE-2026-81655HIGH

Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields

41RISK

open ↗

Referência✓ VexDay Proof

Jupiter CMS 1.1.5 - 'Client-IP' SQL Injection

CVE-2007-0971—webappsphp

Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2013-3729

CVE-2013-3729—

Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hija

23RISK

open ↗

Referência

CVE-2009-4864

CVE-2009-4864—

Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Scrip

23RISK

open ↗

Referência

CVE-2026-14722

CVE-2026-14722MEDIUM

tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection

33RISK

open ↗

Referência

CVE-2009-2424

CVE-2009-2424—

Cross-site scripting (XSS) vulnerability in search.php in Ebay Clone 2009 allows remote attackers to inject arbitrary we

23RISK

open ↗

Referência

CVE-2010-2689

CVE-2010-2689—

SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2013-5730

CVE-2013-5730—

Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remot

23RISK

open ↗

Referência✓ VexDay Proof

FlashGameScript 1.7 - 'user' SQL Injection

CVE-2007-3646—webappsphp

SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

ACG News 1.0 - 'aid'/'catid' SQL Injection

CVE-2007-4603—webappsphp

Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2020-11560

CVE-2020-11560—

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

23RISK

open ↗

Referência✓ VexDay Proof

Chupix CMS 0.2.3 - 'download.php' Remote File Disclosure

CVE-2007-4957—webappsphp

Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overw

23RISK

open ↗

Referência

CVE-2014-5089

CVE-2014-5089—

SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute

23RISK

open ↗

Referência

CVE-2010-0709

CVE-2010-0709—

Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authent

23RISK

open ↗

Referência✓ VexDay Proof

ProfileCMS 1.0 - 'id' SQL Injection

CVE-2007-6058—webappsphp

Multiple SQL injection vulnerabilities in index.php in ProfileCMS 1.0 and earlier allow remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2010-0709

CVE-2010-0709—

Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authent

23RISK

open ↗

Referência✓ VexDay Proof

CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection

CVE-2007-6656—webappsphp

SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote

23RISK

open ↗

Referência

CVE-2009-4616

CVE-2009-4616—

Cross-site scripting (XSS) vulnerability in search.php in MYRE Holiday Rental Manager allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

Brim 2.0.0 - SQL Injection / Cross-Site Scripting

CVE-2008-4083—webappsphp

Cross-site scripting (XSS) vulnerability in the Bookmarks plugin in Brim 2.0 allows remote authenticated users to inject

23RISK

open ↗

Referência

CVE-2015-8635

CVE-2015-8635—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and

28RISK

open ↗

Referência✓ VexDay Proof

Elecard AVC HD Player - '.XPL' Stack Buffer Overflow (SEH) (PoC)

CVE-2009-1356—doswindows

Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 fi

23RISK

open ↗

Referência

CVE-2020-25540

CVE-2020-25540—

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on

60RISK

open ↗

Referência

CVE-2017-11823

CVE-2017-11823—

The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security

23RISK

open ↗

Referência

CVE-2026-102491

CVE-2026-102491MEDIUM

mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection

33RISK

open ↗

Referência

CVE-2006-3362

CVE-2006-3362—

Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) G

23RISK

open ↗

Referência

CVE-2026-102570

CVE-2026-102570HIGH

ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

41RISK

open ↗

Referência

CVE-2026-96762

CVE-2026-96762MEDIUM

kvcache-ai mooncake RPC Path UnmountSegment authorization

33RISK

open ↗

Referência✓ VexDay Proof

AJ Forum 1.0 - 'topic_title.php' SQL Injection

CVE-2007-1295—webappsphp

SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.