Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits

35,420CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência✓ VexDay Proof

Active Force Matrix 2 - Authentication Bypass

CVE-2008-5634—webappsasp

SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2009-4477

CVE-2009-4477—

SQL injection vulnerability in page.html in Xstate Real Estate 1.0 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2009-3967

CVE-2009-3967—

SQL injection vulnerability in browse.php in Ed Charkow SuperCharged Linking allows remote attackers to execute arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

MyioSoft Ajax Portal 3.0 - Authentication Bypass

CVE-2008-5653—webappsphp

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Ktools Photostore 3.5.1 - 'gid' SQL Injection

CVE-2008-6647—webappsphp

SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Tiger Dms - Authentication Bypass

CVE-2009-1503—webappsphp

Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

MaxCMS 2.0 - 'm_username' Arbitrary Create Admin

CVE-2009-1818—webappsphp

SQL injection vulnerability in admin/admin_manager.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

Frontis 3.9.01.24 - 'source_class' SQL Injection

CVE-2009-2013—webappsphp

SQL injection vulnerability in bin/aps_browse_sources.php in Frontis 3.9.01.24 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2010-3026

CVE-2010-3026—

Cross-site request forgery (CSRF) vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open

23RISK

open ↗

Referência✓ VexDay Proof

Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion

CVE-2008-6305—webappsphp

PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al

23RISK

open ↗

Referência✓ VexDay Proof

E-topbiz Link Back Checker 1 - Insecure Cookie Handling

CVE-2008-6307—webappsphp

E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting

23RISK

open ↗

Referência✓ VexDay Proof

E Annu 1.0 - Authentication Bypass / SQL Injection

CVE-2006-5666—webappsphp

SQL injection vulnerability in includes/menu.inc.php in E-Annu 1.0 allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

PunBB (Private Messaging System 1.2.x) - Multiple Local File Inclusions

CVE-2008-6308—webappsphp

Multiple directory traversal vulnerabilities in Private Messaging System (PMS) 1.2.3 and earlier for PunBB allow remote

23RISK

open ↗

Referência

CVE-2026-7238

CVE-2026-7238MEDIUM

code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload

33RISK

open ↗

Referência

CVE-2026-7237

CVE-2026-7237MEDIUM

AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal

33RISK

open ↗

Referência

CVE-2026-7235

CVE-2026-7235MEDIUM

ErlichLiu claude-agent-sdk-master route.ts path traversal

33RISK

open ↗

Referência

CVE-2026-7234

CVE-2026-7234MEDIUM

BrowserOperator browser-operator-core server.js startsWith path traversal

33RISK

open ↗

Referência

CVE-2026-7233

CVE-2026-7233MEDIUM

Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds

33RISK

open ↗

Referência✓ VexDay Proof

cf shopkart 5.2.2 - SQL Injection / File Disclosure

CVE-2008-6320—webappsasp

SQL injection vulnerability in index.cfm in CF Shopkart 5.2.2 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2010-4999

CVE-2010-4999—

SQL injection vulnerability in index.php in esoftpro Online Photo Pro 2.0 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

CFMBLOG - 'categorynbr' Blind SQL Injection

CVE-2008-6322—webappsasp

SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

CF_Auction - Blind SQL Injection

CVE-2008-6323—webappsasp

SQL injection vulnerability in forummessages.cfm in CFMSource CF_Auction allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

CF_Forum - Blind SQL Injection

CVE-2008-6324—webappsasp

SQL injection vulnerability in forummessages.cfm in CF_Forum allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

ProQuiz 1.0 - Authentication Bypass

CVE-2008-6327—webappsphp

SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência

CVE-2010-3742

CVE-2010-3742—

Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attac

23RISK

open ↗

Referência✓ VexDay Proof

Butterfly ORGanizer 2.0.1 - 'id' SQL Injection

CVE-2008-6328—webappsphp

SQL injection vulnerability in view.php in Butterfly Organizer 2.0.0 and 2.0.1 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Pre Job Board - Authentication Bypass

CVE-2008-6329—webappsphp

SQL injection vulnerability in Employee/login.asp in Pre ASP Job Board allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

MyTopix 1.3.0 - SQL Injection

CVE-2008-6330—webappsphp

SQL injection vulnerability in index.php in MyTopix 1.3.0 and earlier allows remote authenticated users to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

Simple Customer 1.2 - Authentication Bypass

CVE-2008-6332—webappsphp

SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

RSS Simple News - SQL Injection

CVE-2008-6333—webappsphp

SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote att

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.