Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,039cataloged exploits

39,796CVEs with public exploitation

24,695lab-tested

All Referência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecent popular risk

25,629 exploits

Referência

CVE-2026-19021

CVE-2026-19021MEDIUM

SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection

33RISK

open ↗

Referência

CVE-2026-18998

CVE-2026-18998MEDIUM

cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization

33RISK

open ↗

Referência

CVE-2010-0761

CVE-2010-0761—

SQL injection vulnerability in index.php in CommodityRentals Books/eBooks Rentals Script allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2010-0799

CVE-2010-0799—

Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read

23RISK

open ↗

Referência

CVE-2026-18997

CVE-2026-18997MEDIUM

cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization

33RISK

open ↗

Referência✓ VexDay Proof

AdminBot 9.0.5 - 'live_status.lib.php' Remote File Inclusion

CVE-2007-2986—webappsphp

PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execu

35RISK

open ↗

Referência

CVE-2010-0799

CVE-2010-0799—

Directory traversal vulnerability in misc/tell_a_friend/tell.php in phpunity.newsmanager allows remote attackers to read

23RISK

open ↗

Referência

CVE-2012-4329

CVE-2012-4329—

The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart

28RISK

open ↗

Referência✓ VexDay Proof

Battle.net Clan Script 1.5.x - SQL Injection

CVE-2008-2522—webappsphp

SQL injection vulnerability in members.php in Battle.net Clan Script for PHP 1.5.3 and earlier, when magic_quotes_gpc is

23RISK

open ↗

Referência✓ VexDay Proof

Scripts24 iTGP 1.0.4 - 'id' SQL Injection

CVE-2008-3491—webappsphp

SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2018-1000049

CVE-2018-1000049—

Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner

60RISK

open ↗

Referência

CVE-2018-9059

CVE-2018-9059—

Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code

60RISK

open ↗

Referência

CVE-2018-9059

CVE-2018-9059—

Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code

60RISK

open ↗

Referência

CVE-2016-0709

CVE-2016-0709—

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3

60RISK

open ↗

Referência✓ VexDay Proof

LiteNews 0.1 - 'id' SQL Injection

CVE-2008-3507—webappsphp

SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Adult Banner Exchange Website - 'targetid' SQL Injection

CVE-2008-6101—webappsphp

SQL injection vulnerability in click.php in Adult Banner Exchange Website allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2017-0290

CVE-2017-0290—

The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve

45RISK

open ↗

Referência✓ VexDay Proof

Goople CMS 1.7 - Insecure Cookie Handling

CVE-2008-6118—webappsphp

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access

23RISK

open ↗

Referência

CVE-2018-1000049

CVE-2018-1000049—

Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner

60RISK

open ↗

Referência✓ VexDay Proof

Drake CMS 0.4.11 - Blind SQL Injection

CVE-2008-6475—webappsphp

SQL injection vulnerability in the guestbook component (components/guestbook/guestbook.php) in Drake CMS 0.4.11 and earl

23RISK

open ↗

Referência

CVE-2009-2567

CVE-2009-2567—

SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers

23RISK

open ↗

Referência

CVE-2012-4361

CVE-2012-4361—

lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to exe

50RISK

open ↗

Referência

CVE-2016-0854

CVE-2016-0854—

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess

60RISK

open ↗

Referência

CVE-2019-6282

CVE-2019-6282—

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpag

23RISK

open ↗

Referência

CVE-2018-15877

CVE-2018-15877—

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta

60RISK

open ↗

Referência

CVE-2016-3718

CVE-2016-3718MEDIUMunder attack

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct

85RISK

open ↗

Referência

CVE-2018-15877

CVE-2018-15877—

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta

60RISK

open ↗

Referência

CVE-2019-6340

CVE-2019-6340HIGHunder attack

Drupal core - Highly critical - Remote Code Execution

100RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Live Ticker 1.0 - Blind SQL Injection

CVE-2008-6148—webappsphp

SQL injection vulnerability in the Live Ticker (com_liveticker) module 1.0 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência

CVE-2026-0993

CVE-2026-0993HIGH

SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.