Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,112cataloged exploits

40,548CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,072VulnCheck XDB 10,121Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2012-1900

CVE-2012-1900—

Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers

23RISK

open ↗

Referência

CVE-2025-15662

CVE-2025-15662HIGH

Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery

41RISK

open ↗

Referência

CVE-2026-67185

CVE-2026-67185HIGH

TinyWeb 0.0.8 Path Traversal via URL Path Component

41RISK

open ↗

Referência✓ VexDay Proof

skyportal vrc6 - Multiple Vulnerabilities

CVE-2007-6078—webappsphp

Multiple SQL injection vulnerabilities in SkyPortal RC6 allow remote attackers to execute arbitrary SQL commands via uns

23RISK

open ↗

Referência✓ VexDay Proof

Sciurus Hosting Panel - Remote Code Injection

CVE-2007-6082—webappsphp

Direct static code injection vulnerability in acp/savenews.php in Sciurus Hosting Panel, possibly 2.0.3, allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection

CVE-2008-6215—webappsphp

Cross-site scripting (XSS) vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels

23RISK

open ↗

Referência✓ VexDay Proof

wotw 5.0 - Local/Remote File Inclusion

CVE-2008-6224—webappsphp

Directory traversal vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers

23RISK

open ↗

Referência

CVE-2009-4583

CVE-2009-4583—

SQL injection vulnerability in the DhForum (com_dhforum) component for Joomla! allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2014-4138

CVE-2014-4138—

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory co

35RISK

open ↗

Referência

CVE-2014-3878

CVE-2014-3878—

Multiple cross-site scripting (XSS) vulnerabilities in the web client interface in Ipswitch IMail Server 12.3 and 12.4,

23RISK

open ↗

Referência✓ VexDay Proof

E-topbiz ADManager 4 - 'group' Blind SQL Injection

CVE-2008-6261—webappsphp

SQL injection vulnerability in view.php in E-topbiz AdManager 4 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2026-86295

CVE-2026-86295MEDIUM

D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection

33RISK

open ↗

Referência

CVE-2026-79615

CVE-2026-79615LOW

Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR

28RISK

open ↗

Referência

CVE-2026-86291

CVE-2026-86291MEDIUM

itsourcecode Sales and Inventory System us_edit1.php sql injection

33RISK

open ↗

Referência

CVE-2026-19423

CVE-2026-19423HIGH

Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms

41RISK

open ↗

Referência

CVE-2026-19084

CVE-2026-19084HIGH

Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read

41RISK

open ↗

Referência

CVE-2026-86290

CVE-2026-86290MEDIUM

SourceCodester Online Voting System ajax.php save_category sql injection

33RISK

open ↗

Referência✓ VexDay Proof

SaturnCMS - Blind SQL Injection

CVE-2008-6263—webappsphp

SQL injection vulnerability in lib/user/t_user.php in SaturnCMS allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2014-5275

CVE-2014-5275—

Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote au

23RISK

open ↗

Referência✓ VexDay Proof

Cyberfolio 7.12.2 - 'theme' Local File Inclusion

CVE-2008-6265—webappsphp

Directory traversal vulnerability in portfolio/css.php in Cyberfolio 7.12.2 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência

CVE-2014-5094

CVE-2014-5094—

Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.p

23RISK

open ↗

Referência✓ VexDay Proof

cf shopkart 5.2.2 - SQL Injection / File Disclosure

CVE-2008-6321—webappsasp

CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

CFMBLOG - 'categorynbr' Blind SQL Injection

CVE-2008-6322—webappsasp

SQL injection vulnerability in index.cfm in CFMSource CFMBlog allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2022-22954

CVE-2022-22954CRITICALunder attackransomware

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RISK

open ↗

Referência

CVE-2018-11776

CVE-2018-11776HIGHunder attack

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN

100RISK

open ↗

Referência

CVE-2026-19899

CVE-2026-19899MEDIUM

SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection

33RISK

open ↗

Referência

CVE-2018-7600

CVE-2018-7600CRITICALunder attackransomware

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

Referência

CVE-2026-19827

CVE-2026-19827MEDIUM

alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal

33RISK

open ↗

Referência

CVE-2026-19895

CVE-2026-19895MEDIUM

opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

33RISK

open ↗

Referência

CVE-2018-7600

CVE-2018-7600CRITICALunder attackransomware

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.