Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2010-2716
CVE-2010-2716—
Multiple SQL injection vulnerabilities in PsNews 1.3 allow remote attackers to execute arbitrary SQL commands via the id
23RISK
open ↗
Referência
CVE-2012-6504
CVE-2012-6504—
SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers t
23RISK
open ↗
Referência
CVE-2012-5894
CVE-2012-5894—
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Unreal Tournament 3 1.3 - Directory Traversal
CVE-2008-4243—remotewindows
Directory traversal vulnerability in ImageServer (aka UTImageServer) in WebAdmin before 1.7 for Epic Games Unreal Tourna
23RISK
open ↗
Referência
CVE-2006-7247
CVE-2006-7247—
SQL injection vulnerability in the Weblinks (com_weblinks) component for Joomla! and Mambo 1.0.9 and earlier allows remo
23RISK
open ↗
Referência
Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting
CVE-2019-9556—webappshardware
FiberHome an5506-04-f RP2669 devices have XSS.
23RISK
open ↗
Referência✓ VexDay Proof
vbzoom 1.x - 'forum.php?MainID' SQL Injection
CVE-2006-3142—webappsphp
SQL injection vulnerability in forum.php in VBZooM 1.11 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
Munch Pro 1.0 - 'switch.asp' SQL Injection
CVE-2006-5880—webappsasp
SQL injection vulnerability on the subMenu page in switch.asp in Munch Pro 1.0 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
UPublisher 1.0 - 'viewarticle.asp' SQL Injection
CVE-2006-5888—webappsasp
SQL injection vulnerability in viewarticle.asp in Superfreaker Studios UPublisher 1.0 allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2010-4808
CVE-2010-4808—
SQL injection vulnerability in index.php in Webmatic allows remote attackers to execute arbitrary SQL commands via the p
23RISK
open ↗
Referência✓ VexDay Proof
Relative Real Estate Systems 3.0 - 'listing_id' SQL Injection
CVE-2008-3185—webappsphp
SQL injection vulnerability in index.php in Relative Real Estate Systems 3.0 and earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2026-67207
CVE-2026-67207HIGH
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
41RISK
open ↗
Referência
CVE-2026-67206
CVE-2026-67206HIGH
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
41RISK
open ↗
Referência
CVE-2012-4055
CVE-2012-4055—
SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2012-2908
CVE-2012-2908—
Multiple SQL injection vulnerabilities in admin/bbcodes.php in Viscacha 0.8.1.1 allow remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
PHPay 2.02 - 'nu_mail.inc.php?mail()' Remote Injection
CVE-2006-4210—webappsphp
nu_mail.inc.php in Andreas Kansok phPay 2.02 and 2.02.1, when register_globals is enabled, allows remote attackers to us
23RISK
open ↗
Referência
CVE-2012-2923
CVE-2012-2923—
SQL injection vulnerability in news.php4 in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-2744
CVE-2010-2744—
The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows
23RISK
open ↗
Referência
CVE-2012-5909
CVE-2012-5909—
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers
23RISK
open ↗
Referência
CVE-2012-1294
CVE-2012-1294—
SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the i
23RISK
open ↗
Referência
CVE-2012-1210
CVE-2012-1210—
SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2017-13258
CVE-2017-13258—
In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead
23RISK
open ↗
Referência
CVE-2017-13258
CVE-2017-13258—
In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead
23RISK
open ↗
Referência
CVE-2010-4835
CVE-2010-4835—
Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users
23RISK
open ↗
Referência
CVE-2012-0980
CVE-2012-0980—
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component Restaurant 1.0 - SQL Injection
CVE-2008-0562—webappsphp
SQL injection vulnerability in index.php in the Restaurant (com_restaurant) 1.0 component for Mambo and Joomla! allows r
23RISK
open ↗
Referência
CVE-2012-0935
CVE-2012-0935—
SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2024-22901
CVE-2024-22901CRITICAL
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
48RISK
open ↗
Referência
CVE-2023-0830
CVE-2023-0830MEDIUM
EasyNAS backup.pl system os command injection
38RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Server - Code Execution (MS08-067)
CVE-2008-4250CRITICALunder attackremotewindows
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20
100RISK
open ↗
← previouspage 421 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.