Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2008-1349

CVE-2008-1349—

SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows

23RISK

open ↗

Referência

CVE-2008-1349

CVE-2008-1349—

SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows

23RISK

open ↗

Referência

CVE-2026-14655

CVE-2026-14655MEDIUM

code-projects Assessment Management view-users.php cross site scripting

33RISK

open ↗

Referência

CVE-2026-14640

CVE-2026-14640MEDIUM

CodeAstro Apartment Visitor Management System Login index.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

CPCommerce 1.2.8 - 'id_document' Blind SQL Injection

CVE-2009-1345—webappsphp

SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2026-14639

CVE-2026-14639MEDIUM

CodeAstro Ecommerce Website my_account.php sql injection

33RISK

open ↗

Referência

CVE-2026-14635

CVE-2026-14635MEDIUM

kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal

33RISK

open ↗

Referência

CVE-2017-2934

CVE-2017-2934—

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Te

28RISK

open ↗

Referência

CVE-2020-11560

CVE-2020-11560—

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.

23RISK

open ↗

Referência✓ VexDay Proof

Chupix CMS 0.2.3 - 'download.php' Remote File Disclosure

CVE-2007-4957—webappsphp

Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overw

23RISK

open ↗

Referência

CVE-2014-5089

CVE-2014-5089—

SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute

23RISK

open ↗

Referência

CVE-2010-0709

CVE-2010-0709—

Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authent

23RISK

open ↗

Referência✓ VexDay Proof

ProfileCMS 1.0 - 'id' SQL Injection

CVE-2007-6058—webappsphp

Multiple SQL injection vulnerabilities in index.php in ProfileCMS 1.0 and earlier allow remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2010-0709

CVE-2010-0709—

Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authent

23RISK

open ↗

Referência✓ VexDay Proof

CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection

CVE-2007-6656—webappsphp

SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote

23RISK

open ↗

Referência

CVE-2009-4616

CVE-2009-4616—

Cross-site scripting (XSS) vulnerability in search.php in MYRE Holiday Rental Manager allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

Brim 2.0.0 - SQL Injection / Cross-Site Scripting

CVE-2008-4083—webappsphp

Cross-site scripting (XSS) vulnerability in the Bookmarks plugin in Brim 2.0 allows remote authenticated users to inject

23RISK

open ↗

Referência

CVE-2015-8635

CVE-2015-8635—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and

28RISK

open ↗

Referência✓ VexDay Proof

Elecard AVC HD Player - '.XPL' Stack Buffer Overflow (SEH) (PoC)

CVE-2009-1356—doswindows

Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 fi

23RISK

open ↗

Referência

CVE-2020-25540

CVE-2020-25540—

ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on

60RISK

open ↗

Referência

CVE-2017-11823

CVE-2017-11823—

The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security

23RISK

open ↗

Referência

CVE-2026-102491

CVE-2026-102491MEDIUM

mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection

33RISK

open ↗

Referência

CVE-2006-3362

CVE-2006-3362—

Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) G

23RISK

open ↗

Referência

CVE-2026-102570

CVE-2026-102570HIGH

ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

41RISK

open ↗

Referência

CVE-2026-96762

CVE-2026-96762MEDIUM

kvcache-ai mooncake RPC Path UnmountSegment authorization

33RISK

open ↗

Referência✓ VexDay Proof

AJ Forum 1.0 - 'topic_title.php' SQL Injection

CVE-2007-1295—webappsphp

SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2009-3191

CVE-2009-3191—

Multiple cross-site scripting (XSS) vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to inject arbitrary w

23RISK

open ↗

Referência

CVE-2010-2906

CVE-2010-2906—

SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remot

23RISK

open ↗

Referência

CVE-2010-1344

CVE-2010-1344—

SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attacke

23RISK

open ↗

Referência

CVE-2010-1344

CVE-2010-1344—

SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attacke

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.