Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits

35,420CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência

CVE-2012-2956

CVE-2012-2956—

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2012-1026

CVE-2012-1026—

Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2012-0913

CVE-2012-0913—

SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute a

23RISK

open ↗

Referência

CVE-2010-2845

CVE-2010-2845—

SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2015-3290

CVE-2015-3290—

arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during n

23RISK

open ↗

Referência

CVE-2010-2845

CVE-2010-2845—

SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2017-13794

CVE-2017-13794—

An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud

23RISK

open ↗

Referência✓ VexDay Proof

Social Engine 3.06 - 'category_id' SQL Injection

CVE-2009-0400—webappsphp

SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass

CVE-2009-0409—webappsphp

SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência

CVE-2010-4847

CVE-2010-4847—

SQL injection vulnerability in view_item.php in MH Products MHP Downloadshop allows remote attackers to execute arbitrar

23RISK

open ↗

Referência

CVE-2023-0913

CVE-2023-0913MEDIUM

SourceCodester Auto Dealer Management System sql injection

33RISK

open ↗

Referência

CVE-2010-4849

CVE-2010-4849—

SQL injection vulnerability in countrydetails.php in Alibaba Clone B2B 3.4 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2012-6508

CVE-2012-6508—

Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hija

23RISK

open ↗

Referência✓ VexDay Proof

iScripts Socialware - 'id' SQL Injection

CVE-2008-1790—webappsphp

Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbit

23RISK

open ↗

Referência

CVE-2012-5320

CVE-2012-5320—

Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

IRSR 0.2 - '_sysSessionPath' Remote File Inclusion

CVE-2006-4237—webappsphp

PHP remote file inclusion vulnerability in pageheaderdefault.inc.php in Invisionix Roaming System Remote (IRSR) 0.2 and

23RISK

open ↗

Referência

CVE-2014-9642

CVE-2014-9642—

bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows loca

23RISK

open ↗

Referência

CVE-2014-9642

CVE-2014-9642—

bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows loca

23RISK

open ↗

Referência

CVE-2012-3294

CVE-2012-3294—

Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfe

23RISK

open ↗

Referência

CVE-2009-3313

CVE-2009-3313—

Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Server - Universal Code Execution (MS08-067)

CVE-2008-4250CRITICALunder attackremotewindows

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20

100RISK

open ↗

Referência

CVE-2017-14016

CVE-2017-14016—

A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The applicati

43RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Server 2000/2003 - Code Execution (MS08-067)

CVE-2008-4250CRITICALunder attackremotewindows

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 20

100RISK

open ↗

Referência

CVE-2017-14075

CVE-2017-14075—

This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must

23RISK

open ↗

Referência

CVE-2017-14075

CVE-2017-14075—

This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must

23RISK

open ↗

Referência✓ VexDay Proof

ECShop 2.5.0 - 'order_sn' SQL Injection

CVE-2009-1622—webappsphp

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

WGCC 0.5.6b - 'quiz.php' SQL Injection

CVE-2006-5514—webappsphp

SQL injection vulnerability in quiz.php in Web Group Communication Center (WGCC) 0.5.6b and earlier allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

PHPMyRing 4.2.1 - 'cherche.php' SQL Injection

CVE-2006-5638—webappsphp

Multiple SQL injection vulnerabilities in cherche.php in PHPMyRing 4.2.1 and earlier allow remote attackers to execute a

23RISK

open ↗

Referência

CVE-2026-4182

CVE-2026-4182CRITICAL

D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow

48RISK

open ↗

Referência

CVE-2026-25873

CVE-2026-25873CRITICAL

OmniGen2-RL Reward Server Unsafe Deserialization RCE

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.