Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2009-4107

CVE-2009-4107—

Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted remote attackers to execute arbitrary code via a craft

23RISK

open ↗

Referência

CVE-2009-4140

CVE-2009-4140—

Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer

60RISK

open ↗

Referência

CVE-2010-4845

CVE-2010-4845—

Multiple SQL injection vulnerabilities in MH Products Projekt Shop allow remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência✓ VexDay Proof

jPORTAL 2 - 'mailer.php' SQL Injection

CVE-2007-5974—webappsphp

SQL injection vulnerability in mailer.php in JPortal 2 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2009-5091

CVE-2009-5091—

SQL injection vulnerability in page.php in Vlinks 1.0.3 and 1.1.6 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2013-1828

CVE-2013-1828—

The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size

23RISK

open ↗

Referência★ 14

HTTP/2 Bomb

CVE-2026-49975HIGH

Apache HTTP Server: mod_http2 denial of service

53RISK

open ↗

Referência

CVE-2025-9605

CVE-2025-9605CRITICAL

Tenda AC21/AC23 GetParentControlInfo stack-based overflow

48RISK

open ↗

Referência

CVE-2016-1583

CVE-2016-1583—

The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to ga

23RISK

open ↗

Referência

CVE-2025-9523

CVE-2025-9523CRITICAL

Tenda AC1206 GetParentControlInfo stack-based overflow

48RISK

open ↗

Referência

CVE-2009-2396

CVE-2009-2396—

PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress p

23RISK

open ↗

Referência

CVE-2010-2911

CVE-2010-2911—

SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2010-2911

CVE-2010-2911—

SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2010-4846

CVE-2010-4846—

SQL injection vulnerability in view_item.php in MH Products Pay Pal Shop Digital allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2026-87892

CVE-2026-87892MEDIUM

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

33RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Carousel Flash Image Gallery - Remote File Inclusion

CVE-2007-6027—webappsphp

PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) compo

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component juser 1.0.14 - Remote File Inclusion

CVE-2007-6038—webappsphp

PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! all

28RISK

open ↗

Referência

CVE-2026-87891

CVE-2026-87891MEDIUM

Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

33RISK

open ↗

Referência✓ VexDay Proof

myEvent 1.6 - 'eventdate' SQL Injection

CVE-2008-4650—webappsphp

SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component mambads 1.0 RC1 Beta - SQL Injection

CVE-2008-5226—webappsphp

SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote atta

23RISK

open ↗

Referência

CVE-2009-3750

CVE-2009-3750—

SQL injection vulnerability in read.php in ToyLog 0.1 allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

SHOP-INET 4 - 'grid' SQL Injection

CVE-2009-0292—webappsphp

SQL injection vulnerability in show_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2010-3026

CVE-2010-3026—

Cross-site request forgery (CSRF) vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open

23RISK

open ↗

Referência

CVE-2010-3027

CVE-2010-3027—

SQL injection vulnerability in index.php in Tycoon Baseball Script 1.0.9 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2016-1595

CVE-2016-1595—

LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows rem

23RISK

open ↗

Referência

CVE-2009-2585

CVE-2009-2585—

SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a m

23RISK

open ↗

Referência

CVE-2009-3713

CVE-2009-3713—

SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2023-29689

CVE-2023-29689—

PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template in

35RISK

open ↗

Referência

CVE-2006-3822

CVE-2006-3822—

SQL injection vulnerability in index.php in GeodesicSolutions GeoAuctions Enterprise 1.0.6 allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

MMSLamp - 'idpro' SQL Injection

CVE-2007-6575—webappsphp

SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.