Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
Joomla! Component com_bookJoomlas 0.1 - SQL Injection
CVE-2009-1263—webappsphp
SQL injection vulnerability in sub_commententry.php in the BookJoomlas (com_bookjoomlas) component 0.1 for Joomla! allow
23RISK
open ↗
Referência
CVE-2009-3317
CVE-2009-3317—
PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to e
23RISK
open ↗
Referência
CVE-2018-7198
CVE-2018-7198—
October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.
23RISK
open ↗
Referência
CVE-2026-101859
CVE-2026-101859MEDIUM
RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection
33RISK
open ↗
Referência
CVE-2018-9092
CVE-2018-9092—
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
23RISK
open ↗
Referência
CVE-2013-10040
CVE-2013-10040CRITICAL
ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2013-10040
CVE-2013-10040CRITICAL
ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE
63RISK
open ↗
Referência✓ VexDay Proof
Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion
CVE-2007-2005—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote at
23RISK
open ↗
Referência
CVE-2017-15730
CVE-2017-15730—
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.
23RISK
open ↗
Referência
CVE-2017-17615
CVE-2017-17615—
Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.
23RISK
open ↗
Referência
CVE-2014-9243
CVE-2014-9243—
Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2026-101858
CVE-2026-101858MEDIUM
RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection
33RISK
open ↗
Referência✓ VexDay Proof
iScripts Socialware - 'id' SQL Injection
CVE-2008-1772—webappsphp
iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sens
23RISK
open ↗
Referência
CVE-2017-17615
CVE-2017-17615—
Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.
23RISK
open ↗
Referência✓ VexDay Proof
BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection
CVE-2008-3784—webappsphp
SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows rem
23RISK
open ↗
Referência
CVE-2012-2940
CVE-2012-2940—
MediaChance Real-DRAW PRO 5.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted (
23RISK
open ↗
Referência
CVE-2012-5228
CVE-2012-5228—
Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions befo
23RISK
open ↗
Referência
CVE-2013-6058
CVE-2013-6058—
SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2010-5289
CVE-2010-5289—
Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component PAX Gallery 0.1 - Blind SQL Injection
CVE-2008-5811—webappsphp
SQL injection vulnerability in the PaxGallery (com_paxgallery) component 0.1 for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2013-6058
CVE-2013-6058—
SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
Aqua CMS - 'Username' SQL Injection
CVE-2009-1317—webappsphp
Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote attackers to exe
23RISK
open ↗
Referência
CVE-2026-102364
CVE-2026-102364MEDIUM
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
33RISK
open ↗
Referência
CVE-2018-14497
CVE-2018-14497—
Tenda D152 ADSL routers allow XSS via a crafted SSID.
23RISK
open ↗
Referência
CVE-2026-13500
CVE-2026-13500MEDIUM
antlr ANTLR4 Grammar Action Block OutputFile.java code injection
33RISK
open ↗
Referência
CVE-2015-6305
CVE-2015-6305—
Untrusted search path vulnerability in the CMainThread::launchDownloader function in vpndownloader.exe in Cisco AnyConne
23RISK
open ↗
Referência
CVE-2019-2000
CVE-2019-2000—
In several functions of binder.c, there is possible memory corruption due to a use after free. This could lead to local
23RISK
open ↗
Referência
CVE-2018-0901
CVE-2018-0901—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência✓ VexDay Proof
microssys CMS 1.5 - Remote File Inclusion
CVE-2008-2396—webappsphp
PHP remote file inclusion vulnerability in index.php in Wajox Software microSSys CMS 1.5 and earlier, when register_glob
23RISK
open ↗
Referência✓ VexDay Proof
Yerba SACphp 6.3 - Multiple Vulnerabilities
CVE-2008-5873—webappsphp
Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galle
23RISK
open ↗
← previouspage 412 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.