Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits

35,300CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecent popular risk

22,175 exploits

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

Referência

CVE-2016-10074

CVE-2016-10074—

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass

35RISK

Referência

CVE-2016-10074

CVE-2016-10074—

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass

35RISK

Referência

CVE-2016-10074

CVE-2016-10074—

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass

35RISK

Referência

CVE-2026-8098

CVE-2026-8098MEDIUM

code-projects Feedback System checklogin.php sql injection

33RISK

Referência✓ VexDay Proof

Globsy 1.0 - 'file' Remote File Disclosure

CVE-2008-0905—webappsphp

Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a

23RISK

Referência✓ VexDay Proof

PHP-Nuke Module Docum - 'artid' SQL Injection

CVE-2008-0906—webappsphp

SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi

23RISK

Referência✓ VexDay Proof

PHP-Nuke Module Inhalt - 'cid' SQL Injection

CVE-2008-0907—webappsphp

SQL injection vulnerability in the Inhalt module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands

23RISK

Referência

CVE-2010-0721

CVE-2010-0721—

SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL comman

23RISK

Referência

CVE-2010-0721

CVE-2010-0721—

SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL comman

23RISK

Referência

CVE-2010-0722

CVE-2010-0722—

SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via

23RISK

Referência

CVE-2020-14750

CVE-2020-14750CRITICALunder attack

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISK

Referência✓ VexDay Proof

MultiCart 2.0 - 'productdetails.php' SQL Injection

CVE-2008-0911—webappsphp

SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute

23RISK

Referência

CVE-2010-2613

CVE-2010-2613—

Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remo

23RISK

Referência

CVE-2010-2613

CVE-2010-2613—

Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remo

23RISK

Referência

CVE-2010-2617

CVE-2010-2617—

Cross-site scripting (XSS) vulnerability in bible.php in PHP Bible Search allows remote attackers to inject arbitrary we

23RISK

Referência

CVE-2010-2675

CVE-2010-2675—

Cross-site scripting (XSS) vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to inject a

23RISK

Referência

CVE-2010-2682

CVE-2010-2682—

Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote a

43RISK

Referência

CVE-2010-2847

CVE-2010-2847—

Multiple SQL injection vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allo

23RISK

Referência

CVE-2010-2917

CVE-2010-2917—

Multiple cross-site scripting (XSS) vulnerabilities in index.php in AJ Square AJ Article 3.0 allow remote attackers to i

23RISK

Referência

CVE-2010-3426

CVE-2010-3426—

Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remo

43RISK

Referência

CVE-2010-3426

CVE-2010-3426—

Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remo

43RISK

Referência✓ VexDay Proof

Affiliate Market 0.1 Beta - Cross-Site Scripting / SQL Injection

CVE-2008-1177—webappsphp

SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execu

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.