Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Realty Web-Base 1.0 - 'list_list.php?id' SQL Injection
CVE-2009-1751—webappsphp
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2017-17603
CVE-2017-17603—
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_
23RISK
open ↗
Referência
CVE-2017-17605
CVE-2017-17605—
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
23RISK
open ↗
Referência
CVE-2026-16219
CVE-2026-16219MEDIUM
Croogo CMS Admin File Manager FileManager.php isEditable path traversal
33RISK
open ↗
Referência✓ VexDay Proof
Kmita Mail 3.0 - 'file' Remote File Inclusion
CVE-2008-2199—webappsphp
PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_g
23RISK
open ↗
Referência✓ VexDay Proof
Winamp 5.551 - MAKI Parsing Integer Overflow
CVE-2009-1831—localwindows
The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute
50RISK
open ↗
Referência
CVE-2022-30190
CVE-2022-30190HIGHunder attackransomware
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗
Referência✓ VexDay Proof
MyForum 1.3 - Authentication Bypass
CVE-2009-1852—webappsphp
Multiple SQL injection vulnerabilities in Graphiks MyForum 1.3 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal
CVE-2009-1873—remotewindows
Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4
23RISK
open ↗
Referência
CVE-2010-1723
CVE-2010-1723—
Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! all
38RISK
open ↗
Referência
CVE-2015-1701
CVE-2015-1701HIGHunder attackransomware
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local
98RISK
open ↗
Referência✓ VexDay Proof
PHP Krazy Image Hosting 0.7a - 'display.php' SQL Injection
CVE-2006-5140—webappsphp
SQL injection vulnerability in display.php in Lappy512 PHP Krazy Image Host Script (phpkimagehost) 0.7a allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities
CVE-2009-1947—webappsphp
SQL injection vulnerability in the UnbDbEncode function in unb_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.
23RISK
open ↗
Referência
CVE-2023-27372
CVE-2023-27372CRITICAL
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗
Referência✓ VexDay Proof
How2ASP.net WebBoard 4.1 - SQL Injection
CVE-2008-2417—webappsphp
SQL injection vulnerability in showQAnswer.asp in How2ASP.net Webboard 4.1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Password Protector SD 1.3.1 - Insecure Cookie Handling
CVE-2009-2003—webappsphp
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗
Referência✓ VexDay Proof
Family Connections CMS 1.9 - SQL Injection
CVE-2009-2010—webappsphp
Multiple SQL injection vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 1.9 and earlier allow remote authen
23RISK
open ↗
Referência
CVE-2010-0690
CVE-2010-0690—
SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2014-6446
CVE-2014-6446—
The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows
50RISK
open ↗
Referência
CVE-2026-109620
CVE-2026-109620MEDIUM
SourceCodester Online Reviewer System index.php prepare sql injection
33RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Photoracer 1.0 - 'id' SQL Injection
CVE-2009-2122—webappsphp
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
WiClear 0.10 - 'path' Remote File Inclusion
CVE-2006-5506—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WiClear 0.10 allow remote attackers to execute arbitrary PHP code
28RISK
open ↗
Referência
CVE-2026-58659
CVE-2026-58659HIGH
PyTorch Lightning Arbitrary Code Execution via _instantiator Hyperparameter
41RISK
open ↗
Referência
CVE-2026-15750
CVE-2026-15750MEDIUM
mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
33RISK
open ↗
Referência
CVE-2020-14750
CVE-2020-14750CRITICALunder attack
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
Referência
CVE-2026-8098
CVE-2026-8098MEDIUM
code-projects Feedback System checklogin.php sql injection
33RISK
open ↗
Referência
CVE-2017-6444
CVE-2017-6444—
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
28RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
Referência
CVE-2023-29809
CVE-2023-29809CRITICAL
SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit
53RISK
open ↗
Referência✓ VexDay Proof
Cmaps v8.0 - SQL injection
CVE-2023-29809CRITICALwebappsphp
SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbit
53RISK
open ↗
← previouspage 398 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.