Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2010-4734
CVE-2010-4734—
Multiple cross-site scripting (XSS) vulnerabilities in the comment feature in Skeletonz CMS 1.0, when the Blog plugin is
23RISK
open ↗
Referência
CVE-2012-4054
CVE-2012-4054—
Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers
23RISK
open ↗
Referência
CVE-2010-4737
CVE-2010-4737—
SQL injection vulnerability in resorts.asp in HotWebScripts HotWeb Rentals allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-72777
CVE-2026-72777HIGH
Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
41RISK
open ↗
Referência
CVE-2016-0965
CVE-2016-0965—
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RISK
open ↗
Referência
CVE-2026-102364
CVE-2026-102364MEDIUM
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
33RISK
open ↗
Referência✓ VexDay Proof
xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion
CVE-2007-5314—webappsphp
PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register_globals is enabled
23RISK
open ↗
Referência
CVE-2026-101070
CVE-2026-101070MEDIUM
dbgate Files Endpoint runners.js files path traversal
33RISK
open ↗
Referência
CVE-2026-101069
CVE-2026-101069MEDIUM
dbgate Export databaseConnections.js exportModelSql path traversal
33RISK
open ↗
Referência
CVE-2026-19894
CVE-2026-19894MEDIUM
itsourcecode Hospital Management System viewmedicine.php sql injection
33RISK
open ↗
Referência
CVE-2026-73515
CVE-2026-73515HIGH
PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer
41RISK
open ↗
Referência
CVE-2026-11782
CVE-2026-11782MEDIUM
Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
doITlive CMS 2.50 - SQL Injection / Cross-Site Scripting
CVE-2008-2843—webappsasp
Multiple SQL injection vulnerabilities in doITLive CMS 2.50 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
ZeeReviews - SQL Injection
CVE-2008-3669—webappsphp
SQL injection vulnerability in comments.php in ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script (ak
23RISK
open ↗
Referência✓ VexDay Proof
zeeproperty - 'adid' SQL Injection
CVE-2008-4621—webappsphp
SQL injection vulnerability in bannerclick.php in ZeeScripts Zeeproperty allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2010-1070
CVE-2010-1070—
SQL injection vulnerability in index.php in ImagoScripts Deviant Art Clone allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-1070
CVE-2010-1070—
SQL injection vulnerability in index.php in ImagoScripts Deviant Art Clone allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-2338
CVE-2010-2338—
Multiple SQL injection vulnerabilities in redir.asp in VU Web Visitor Analyst allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Online Booking Manager 2.2 - 'id' SQL Injection
CVE-2008-5194—webappsphp
SQL injection vulnerability in checkavail.php in SoftVisions Software Online Booking Manager (obm) 2.2 allows remote att
23RISK
open ↗
Referência
CVE-2010-4632
CVE-2010-4632—
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2010-4632
CVE-2010-4632—
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
Domain Seller Pro 1.5 - 'id' SQL Injection
CVE-2008-5788—webappsphp
SQL injection vulnerability in index.php in Domain Seller Pro 1.5 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2010-4814
CVE-2010-4814—
SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attacke
23RISK
open ↗
Referência
CVE-2011-1055
CVE-2011-1055—
SQL injection vulnerability in api/ice_media.cfc in Lingxia I.C.E CMS 1.0 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2016-0967
CVE-2016-0967—
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RISK
open ↗
Referência✓ VexDay Proof
bSpeak 1.10 - 'forumid' Blind SQL Injection
CVE-2009-1747—webappsphp
SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-0158
CVE-2010-0158—
SQL injection vulnerability in the JoomlaBamboo (JB) Simpla Admin template for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2010-0158
CVE-2010-0158—
SQL injection vulnerability in the JoomlaBamboo (JB) Simpla Admin template for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2010-1660
CVE-2010-1660—
SQL injection vulnerability in help-details.php in CLScript Classifieds Script allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2010-1660
CVE-2010-1660—
SQL injection vulnerability in help-details.php in CLScript Classifieds Script allows remote attackers to execute arbitr
23RISK
open ↗
← previouspage 313 / 873next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.