Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,997cataloged exploits
40,455CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
blur6ex 0.3.462 - 'ID' Admin Disclosure / Blind SQL Injection
CVE-2006-3065—webappsphp
SQL injection vulnerability in engine/shards/blog.php in blur6ex 0.3.462 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
PHP Forge 3 Beta 2 - 'id' SQL Injection
CVE-2008-2088—webappsphp
SQL injection vulnerability in admin/news.php in PHP Forge 3.0 beta 2 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component ClickHeat 1.0.1 - Multiple Remote File Inclusions
CVE-2008-5793—webappsphp
Multiple PHP remote file inclusion vulnerabilities in the Clickheat - Heatmap stats (com_clickheat) component 1.0.1 for
28RISK
open ↗
Referência✓ VexDay Proof
E-topbiz Online Store 1 - Authentication Bypass
CVE-2008-5803—webappsphp
SQL injection vulnerability in admin/login.php in E-topbiz Online Store 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
AGTC MyShop 3.2 - Insecure Cookie Handling
CVE-2009-1549—webappsphp
AGTC MyShop 3.2b allows remote attackers to bypass authentication and obtain administrative access setting the log_accep
23RISK
open ↗
Referência✓ VexDay Proof
Qt QuickTeam - Multiple Remote File Inclusions
CVE-2009-1551—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP cod
35RISK
open ↗
Referência
CVE-2022-44877
CVE-2022-44877CRITICALunder attack
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RISK
open ↗
Referência
CVE-2026-94229
CVE-2026-94229MEDIUM
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
33RISK
open ↗
Referência✓ VexDay Proof
The Real Estate Script - 'docID' SQL Injection
CVE-2008-2443—webappsphp
SQL injection vulnerability in dpage.php in The Real Estate Script allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2015-1427
CVE-2015-1427CRITICALunder attack
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RISK
open ↗
Referência
CVE-2022-45639
CVE-2022-45639HIGH
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cra
41RISK
open ↗
Referência
CVE-2015-8425
CVE-2015-8425—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and
35RISK
open ↗
Referência✓ VexDay Proof
Emefa Guestbook 3.0 - Remote Database Disclosure
CVE-2008-5852—webappsasp
Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remot
23RISK
open ↗
Referência
CVE-2016-0016
CVE-2016-0016—
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
28RISK
open ↗
Referência
CVE-2016-0111
CVE-2016-0111—
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a
35RISK
open ↗
Referência
CVE-2017-15291
CVE-2017-15291—
Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows
23RISK
open ↗
Referência
CVE-2016-0040
CVE-2016-0040HIGHunder attack
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to g
91RISK
open ↗
Referência✓ VexDay Proof
SDP Downloader 2.3.0 - '.asx' Local Buffer Overflow (SEH) (1)
CVE-2009-1627—localwindows
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
Simple Customer 1.3 - Arbitrary Change Admin Password
CVE-2009-1637—webappsphp
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to chan
23RISK
open ↗
Referência
CVE-2015-1497
CVE-2015-1497—
radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execu
60RISK
open ↗
Referência✓ VexDay Proof
docpile:we 0.2.2 - 'INIT_PATH' Remote File Inclusion
CVE-2006-4075—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Wim Fleischhauer docpile: wim's edition (docpile:we) 0.2.2 and ear
28RISK
open ↗
Referência
CVE-2023-0297
CVE-2023-0297CRITICAL
Code Injection in pyload/pyload
85RISK
open ↗
Referência✓ VexDay Proof
Hitweb 4.2.1 - 'REP_INC' Remote File Inclusion
CVE-2006-4113—webappsphp
PHP remote file inclusion vulnerability in genpage-cgi.php in Brian Fraval hitweb 4.2 and possibly earlier versions allo
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer 6 - DirectX Media Remote Overflow Denial of Service
CVE-2006-4301—doswindows
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) via a long Color attrib
35RISK
open ↗
Referência
CVE-2023-0669
CVE-2023-0669HIGHunder attackransomware
Fortra GoAnywhere MFT License Response Servlet Command Injection
100RISK
open ↗
Referência
CVE-2017-17638
CVE-2017-17638—
Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.
23RISK
open ↗
Referência
CVE-2010-0459
CVE-2010-0459—
SQL injection vulnerability in the Mochigames (com_mochigames) component 0.51 and possibly other versions for Joomla! al
23RISK
open ↗
Referência
CVE-2017-17641
CVE-2017-17641—
Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Bible Study 1.5.0 - 'id' SQL Injection
CVE-2008-2643—webappsphp
SQL injection vulnerability in the Bible Study (com_biblestudy) component before 6.0.7c for Joomla! allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Booby 1.0.1 - Multiple Remote File Inclusions
CVE-2008-2645—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Brim (formerly Booby) 1.0.1 allow remote attackers to execute arbi
35RISK
open ↗
← previouspage 417 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.