Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2008-4157
CVE-2008-4157—
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2025-34099
CVE-2025-34099CRITICAL
VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
63RISK
open ↗
Referência
CVE-2025-34099
CVE-2025-34099CRITICAL
VICIdial vicidial_sales_viewer.php Unauthenticated Command Injection via Basic Auth Password
63RISK
open ↗
Referência
CVE-2010-2673
CVE-2010-2673—
SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-2673
CVE-2010-2673—
SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-64827
CVE-2026-64827CRITICAL
Telenia TVox 26.5.3 Authentication Bypass via set_env.php
48RISK
open ↗
Referência✓ VexDay Proof
MOTIONBORG Web Real Estate 2.1 - SQL Injection
CVE-2007-0196—webappsasp
SQL injection vulnerability in admin_check_user.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attacker
23RISK
open ↗
Referência
CVE-2009-4552
CVE-2009-4552—
Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbi
23RISK
open ↗
Referência
CVE-2010-2700
CVE-2010-2700—
Cross-site scripting (XSS) vulnerability in index.php in Edge PHP Clickbank Affiliate Marketplace Script (CBQuick) allow
23RISK
open ↗
Referência✓ VexDay Proof
MyFWB 1.0 - 'index.php' SQL Injection
CVE-2008-5097—webappsphp
SQL injection vulnerability in index.php in MyFWB 1.0 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2009-3420
CVE-2009-3420—
Multiple cross-site scripting (XSS) vulnerabilities in index.php in the Publisher module 2.0 for Miniweb allow remote at
23RISK
open ↗
Referência
CVE-2007-3812
CVE-2007-3812—
SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2007-3812
CVE-2007-3812—
SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2014-7822
CVE-2014-7822—
The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restrictio
23RISK
open ↗
Referência
CVE-2024-13980
CVE-2024-13980CRITICAL
H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
48RISK
open ↗
Referência
CVE-2024-13980
CVE-2024-13980CRITICAL
H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
48RISK
open ↗
Referência
CVE-2024-13980
CVE-2024-13980CRITICAL
H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
48RISK
open ↗
Referência
CVE-2024-13980
CVE-2024-13980CRITICAL
H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
48RISK
open ↗
Referência
CVE-2009-2894
CVE-2009-2894—
Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2017-12579
CVE-2017-12579—
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and ear
23RISK
open ↗
Referência
CVE-2009-0445
CVE-2009-0445—
SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2010-0720
CVE-2010-0720—
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-0720
CVE-2010-0720—
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-4619
CVE-2010-4619—
SQL injection vulnerability in profil.php in Mafya Oyun Scrpti (aka Mafia Game Script) allows remote attackers to execut
23RISK
open ↗
Referência✓ VexDay Proof
DreamPics Photo/Video Gallery - Blind SQL Injection
CVE-2009-0445—webappsphp
SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2026-16297
CVE-2026-16297MEDIUM
Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import
33RISK
open ↗
Referência✓ VexDay Proof
HLStats 1.34 - 'hlstats.php' SQL Injection
CVE-2006-6780—webappsphp
SQL injection vulnerability in the login form in HLstats 1.20 through 1.34 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2025-34061
CVE-2025-34061CRITICAL
PHPStudy 2016-2018 Backdoor Remote Code Execution Vulnerability
63RISK
open ↗
Referência✓ VexDay Proof
AssetMan 2.5-b - SQL Injection using Session Fixation
CVE-2008-4161—webappsphp
SQL injection vulnerability in search_inv.php in Assetman 2.5b allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
MemHT Portal 3.9.0 - Remote Create Shell
CVE-2008-4164—webappsphp
cron.php in MemHT Portal 3.9.0 and earlier allows remote attackers to obtain sensitive information via a direct request,
23RISK
open ↗
← previouspage 422 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.