Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Netious CMS 0.4 - 'pageid' SQL Injection
SQL injection vulnerability in index.php in Netious CMS 0.4 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Referência
CVE-2010-4911
SQL injection vulnerability in classi/detail.php in PHP Classifieds Ads allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2016-1611
Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.
23RISK
open ↗Referência
CVE-2017-15921
In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NULL pointer
23RISK
open ↗Referência
CVE-2017-7620
MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequen
23RISK
open ↗Referência✓ VexDay Proof
MojoClassifieds 2.0 - Blind SQL Injection
SQL injection vulnerability in mojoClassified.cgi in MojoClassifieds 2.0 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Living Local Website - 'listtest.php' SQL Injection
SQL injection vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Vastal I-Tech Cosmetics Zone - 'cat_id' SQL Injection
SQL injection vulnerability in view_products_cat.php in Vastal I-Tech Cosmetics Zone allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
Shahrood - Blind SQL Injection
SQL injection vulnerability in ndetail.php in Shahrood allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Referência✓ VexDay Proof
Nitrotech 0.0.3a - Remote File Inclusion / SQL Injection
SQL injection vulnerability in members.php in NitroTech 0.0.3a allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
eDNews 2.0 - SQL Injection
SQL injection vulnerability in eDNews_view.php in eDreamers eDNews 2 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência✓ VexDay Proof
Ocean12 Membership Manager Pro - Authentication Bypass
SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Easy Photo Gallery 2.1 - Cross-Site Scripting / File Disclosure/Bypass / SQL Injection
SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to exe
23RISK
open ↗Referência
CVE-2009-3117
SQL injection vulnerability in category.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2009-4197
rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 contains a form that does not disable the au
23RISK
open ↗Referência
CVE-2026-9582
SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery
33RISK
open ↗Referência✓ VexDay Proof
Apple Safari / QuickTime 7.3 - RTSP Content-Type Remote Buffer Overflow
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac
50RISK
open ↗Referência
CVE-2008-3719
SQL injection vulnerability in directory.php in SFS Affiliate Directory allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2025-4318
Input validation issue in AWS Amplify Studio UI component properties
48RISK
open ↗Referência
CVE-2017-15962
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
23RISK
open ↗Referência
CVE-2017-15962
iStock Management System 1.0 allows Arbitrary File Upload via user/profile.
23RISK
open ↗Referência✓ VexDay Proof
E-topbiz Number Links 1 - 'id' SQL Injection
SQL injection vulnerability in admin/admin_catalog.php in e-topbiz Number Links 1 Php Script allows remote attackers to
23RISK
open ↗Referência
CVE-2026-76555
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
33RISK
open ↗Referência
CVE-2010-4937
Multiple SQL injection vulnerabilities in the Amblog (com_amblog) component 1.0 for Joomla! allow remote attackers to ex
23RISK
open ↗Referência
CVE-2012-2760
mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local us
23RISK
open ↗Referência✓ VexDay Proof
SFS EZ Auction - Blind SQL Injection
SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arb
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute
23RISK
open ↗Referência
CVE-2012-2760
mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local us
23RISK
open ↗Referência
CVE-2009-5088
SQL injection vulnerability in secure/index.php in IdeaCart 0.02 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.