Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2024-8878
CVE-2024-8878CRITICAL
Unauthenticated Password Reset
48RISK
open ↗
Referência
CVE-2010-4243
CVE-2010-4243—
fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays repre
23RISK
open ↗
Referência
CVE-2010-4249
CVE-2010-4249—
The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properl
23RISK
open ↗
Referência
CVE-2022-35156
CVE-2022-35156CRITICAL
Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /
48RISK
open ↗
Referência
CVE-2022-35156
CVE-2022-35156CRITICAL
Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /
48RISK
open ↗
Referência✓ VexDay Proof
AJ HYIP ACME - 'readarticle.php' SQL Injection
CVE-2008-4044—webappsphp
SQL injection vulnerability in article/readarticle.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers t
23RISK
open ↗
Referência
CVE-2026-28292
CVE-2026-28292CRITICAL
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE
48RISK
open ↗
Referência
CVE-2009-4984
CVE-2009-4984—
Multiple cross-site scripting (XSS) vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to
23RISK
open ↗
Referência
CVE-2008-4046
CVE-2008-4046—
SQL injection vulnerability in index.php in eliteCMS 1.0 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2013-6079
CVE-2013-6079—
Buffer overflow in MostGear Soft Easy LAN Folder Share 3.2.0.100 allows local users to cause a denial of service (applic
23RISK
open ↗
Referência
CVE-2013-6079
CVE-2013-6079—
Buffer overflow in MostGear Soft Easy LAN Folder Share 3.2.0.100 allows local users to cause a denial of service (applic
23RISK
open ↗
Referência
CVE-2013-6079
CVE-2013-6079—
Buffer overflow in MostGear Soft Easy LAN Folder Share 3.2.0.100 allows local users to cause a denial of service (applic
23RISK
open ↗
Referência✓ VexDay Proof
aspWebLinks 2.0 - SQL Injection / Admin Pass Change
CVE-2006-2847—webappsasp
SQL injection vulnerability in links.asp in aspWebLinks 2.0 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting
CVE-2020-29233—webappsphp
WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allo
23RISK
open ↗
Referência✓ VexDay Proof
campus virtual-lms - Cross-Site Scripting / SQL Injection
CVE-2009-2149—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2009-4567
CVE-2009-4567—
Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated u
23RISK
open ↗
Referência
CVE-2009-4567
CVE-2009-4567—
Multiple cross-site scripting (XSS) vulnerabilities in editprofile.php in Viscacha 0.8 Gold allow remote authenticated u
23RISK
open ↗
Referência
CVE-2008-5689
CVE-2008-5689—
tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (pa
23RISK
open ↗
Referência
CVE-2010-2609
CVE-2010-2609—
SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2010-2609
CVE-2010-2609—
SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2026-8081
CVE-2026-8081MEDIUM
router-for-me CLIProxyAPI api_tools.go server-side request forgery
33RISK
open ↗
Referência
CVE-2026-7414
CVE-2026-7414CRITICAL
Hardcoded credentials in Yarbo robot firmware
48RISK
open ↗
Referência
CVE-2026-7413
CVE-2026-7413HIGH
Persistent undocumented backdoor access in Yarbo robot
41RISK
open ↗
Referência
CVE-2012-4240
CVE-2012-4240—
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authentic
23RISK
open ↗
Referência✓ VexDay Proof
BrewBlogger 1.3.1 - 'printLog.php' SQL Injection
CVE-2006-5889—webappsphp
SQL injection vulnerability in printLog.php in BrewBlogger (BB) 1.3.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2009-3348
CVE-2009-3348—
Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência✓ VexDay Proof
OpenLD 1.2.2 - 'index.php?id' SQL Injection
CVE-2007-3682—webappsphp
SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2018-4863
CVE-2018-4863—
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKE
23RISK
open ↗
Referência✓ VexDay Proof
AdaptCMS Lite 1.3 - Blind SQL Injection
CVE-2008-4524—webappsphp
SQL injection vulnerability in the "Check User" feature (includes/check_user.php) in AdaptCMS Lite and AdaptCMS Pro 1.3
23RISK
open ↗
Referência
CVE-2009-3755
CVE-2009-3755—
Multiple cross-site scripting (XSS) vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script
23RISK
open ↗
← previouspage 429 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.