Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2014-5308

CVE-2014-5308—

Multiple SQL injection vulnerabilities in TestLink 1.9.11 allow remote authenticated users to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2011-1569

CVE-2011-1569—

download.aspx in Douran Portal 3.9.7.8 allows remote attackers to obtain source code of arbitrary files under the web ro

23RISK

open ↗

Referência

CVE-2017-0123

CVE-2017-0123—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência

CVE-2017-5473

CVE-2017-5473—

Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authenticati

23RISK

open ↗

Referência

CVE-2026-90511

CVE-2026-90511MEDIUM

GongShengyue OnlineBooks listSplit BooksServlet.java sql injection

33RISK

open ↗

Referência

CVE-2026-82624

CVE-2026-82624MEDIUM

code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure

33RISK

open ↗

Referência

CVE-2015-2166

CVE-2015-2166—

Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5

43RISK

open ↗

Referência

CVE-2026-90508

CVE-2026-90508MEDIUM

Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization

33RISK

open ↗

Referência✓ VexDay Proof

FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion

CVE-2007-1133—webappsphp

PHP remote file inclusion vulnerability in fcring.php in FCRing 1.3 allows remote attackers to execute arbitrary PHP cod

23RISK

open ↗

Referência✓ VexDay Proof

FlashBlog - 'articulo_id' SQL Injection

CVE-2008-2572—webappsphp

SQL injection vulnerability in php/leer_comentarios.php in FlashBlog allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.04 - Blind SQL Injection

CVE-2008-4494—webappsphp

SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote at

23RISK

open ↗

Referência

CVE-2012-1669

CVE-2012-1669—

Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and exec

23RISK

open ↗

Referência

CVE-2006-2226

CVE-2006-2226—

Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv

23RISK

open ↗

Referência

CVE-2018-7543

CVE-2018-7543—

Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for

23RISK

open ↗

Referência

CVE-2014-10035

CVE-2014-10035—

Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrat

23RISK

open ↗

Referência

CVE-2014-9522

CVE-2014-9522—

Multiple cross-site scripting (XSS) vulnerabilities in CMS Papoo Light 6.0.0 (Rev 4701) allow remote attackers to inject

23RISK

open ↗

Referência

CVE-2017-0126

CVE-2017-0126—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência

CVE-2014-10035

CVE-2014-10035—

Multiple cross-site scripting (XSS) vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrat

23RISK

open ↗

Referência

CVE-2014-8653

CVE-2014-8653—

Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit

23RISK

open ↗

Referência

CVE-2019-6263

CVE-2019-6263—

An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allo

23RISK

open ↗

Referência

CVE-2014-8653

CVE-2014-8653—

Cross-site scripting (XSS) vulnerability in Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 wit

23RISK

open ↗

Referência✓ VexDay Proof

Pre News Manager 1.0 - 'id' SQL Injection

CVE-2006-2763—webappsphp

SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the (1

23RISK

open ↗

Referência

CVE-2026-9347

CVE-2026-9347MEDIUM

Edimax EW-7438RPn webs formWizSurvey os command injection

33RISK

open ↗

Referência✓ VexDay Proof

SAPID 1.2.3.05 - 'ROOT_PATH' Remote File Inclusion

CVE-2006-4026—webappsphp

PHP remote file inclusion vulnerability in SAPID CMS 123 rc3 allows remote attackers to execute arbitrary PHP code via a

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component acctexp 0.12.x - Blind SQL Injection

CVE-2008-2632—webappsphp

SQL injection vulnerability in the acctexp (com_acctexp) component 0.12.x and earlier for Joomla! allows remote attacker

23RISK

open ↗

Referência✓ VexDay Proof

Fastpublish CMS 1.9999 - Local File Inclusion / SQL Injection

CVE-2008-4518—webappsphp

Multiple SQL injection vulnerabilities in Fastpublish CMS 1.9.9.9.9 d (1.9999 d) allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2009-4578

CVE-2009-4578—

Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows rem

23RISK

open ↗

Referência

CVE-2025-34029

CVE-2025-34029CRITICAL

Edimax EW-7438RPn Mini OS Command Injection via syscmd.asp

48RISK

open ↗

Referência

CVE-2018-6230

CVE-2018-6230—

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 search configuration script could allow an

23RISK

open ↗

Referência

CVE-2018-19933

CVE-2018-19933—

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and Ne

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.