Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2026-75148

CVE-2026-75148MEDIUM

cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check

13RISK

open ↗

Referência

CVE-2009-2927

CVE-2009-2927—

SQL injection vulnerability in DetailFile.php in DigitalSpinners DS CMS 1.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2009-4583

CVE-2009-4583—

SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2010-3211

CVE-2010-3211—

Multiple SQL injection vulnerabilities in the JE FAQ Pro (com_jefaqpro) component 1.5.0 for Joomla! allow remote attacke

23RISK

open ↗

Referência

CVE-2026-8777

CVE-2026-8777MEDIUM

Edimax BR-6428NS POST Request formStaDrvSetup command injection

33RISK

open ↗

Referência

CVE-2017-20261

CVE-2017-20261HIGH

Joomla! Component Bargain Product VM3 1.0 SQL Injection

41RISK

open ↗

Referência

CVE-2026-8776

CVE-2026-8776HIGH

Edimax BR-6428NS POST Request formPPTPSetup buffer overflow

41RISK

open ↗

Referência

CVE-2017-20260

CVE-2017-20260HIGH

Joomla! Component Price Alert 3.0.2 SQL Injection

41RISK

open ↗

Referência

CVE-2017-17575

CVE-2017-17575—

FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.

23RISK

open ↗

Referência

CVE-2017-20259

CVE-2017-20259HIGH

Joomla OSDownloads 1.7.4 SQL Injection via item view

41RISK

open ↗

Referência✓ VexDay Proof

Libera CMS 1.12 - 'cookie' SQL Injection

CVE-2008-4700—webappsphp

SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remot

23RISK

open ↗

Referência

CVE-2026-8981

CVE-2026-8981LOW

Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML

28RISK

open ↗

Referência

CVE-2026-11585

CVE-2026-11585MEDIUM

CodeAstro Student Attendance Management System createClassArms.php sql injection

33RISK

open ↗

Referência

CVE-2009-4599

CVE-2009-4599—

Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers

23RISK

open ↗

Referência

CVE-2009-4600

CVE-2009-4600—

SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attacke

23RISK

open ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALunder attack

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALunder attack

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2026-7315

CVE-2026-7315MEDIUM

eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal

33RISK

open ↗

Referência

CVE-2016-2386

CVE-2016-2386CRITICALunder attack

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2017-17597

CVE-2017-17597—

Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.

23RISK

open ↗

Referência

CVE-2026-87924

CVE-2026-87924MEDIUM

Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication

33RISK

open ↗

Referência

CVE-2026-19035

CVE-2026-19035HIGH

Shibby Tomato qoslimit new_qoslimit_start os command injection

41RISK

open ↗

Referência✓ VexDay Proof

k_shoutbox 4.4 - Remote File Inclusion

CVE-2006-3989—webappsphp

PHP remote file inclusion vulnerability in index.php in Knusperleicht Shoutbox 4.4 and earlier allows remote attackers t

23RISK

open ↗

Referência

CVE-2011-4453

CVE-2011-4453—

The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitra

50RISK

open ↗

Referência

CVE-2016-2784

CVE-2016-2784—

CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduc

23RISK

open ↗

Referência

CVE-2017-9150

CVE-2017-9150—

The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the allow_ptr_leaks value

23RISK

open ↗

Referência

CVE-2026-87923

CVE-2026-87923MEDIUM

Rizwan17 inventory-management-system List DBOperation.php cross site scripting

33RISK

open ↗

Referência

CVE-2026-19009

CVE-2026-19009MEDIUM

TinyAGI Message API Endpoint response.ts collectFiles file inclusion

33RISK

open ↗

Referência✓ VexDay Proof

QuestCMS - Cross-Site Scripting / Directory Traversal / SQL Injection

CVE-2008-4772—webappsphp

SQL injection vulnerability in main/main.php in QuestCMS allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2026-10690

CVE-2026-10690MEDIUM

wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.