Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,166cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,078VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
Joomla! Component JE PayperVideo 3.0.0 - 'usr_plan' SQL Injection
CVE-2018-6578—webappsphp
SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task
23RISK
open ↗
Referência
CVE-2026-10176
CVE-2026-10176MEDIUM
Aider-AI Aider Code Generation Workflow sql injection
33RISK
open ↗
Referência
CVE-2026-10175
CVE-2026-10175MEDIUM
Aider-AI Aider Architect Mode auth.py editor_coder.run code injection
33RISK
open ↗
Referência
CVE-2018-6604
CVE-2018-6604—
SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetail
23RISK
open ↗
Referência✓ VexDay Proof
openPHPNuke 2.3.3 - Remote File Inclusion
CVE-2006-2137—webappsphp
PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2019-6214
CVE-2019-6214—
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.1
23RISK
open ↗
Referência
CVE-2023-36348
CVE-2023-36348—
POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename p
23RISK
open ↗
Referência✓ VexDay Proof
Hunkaray Duyuru Scripti - 'tr' SQL Injection
CVE-2007-0688—webappsasp
SQL injection vulnerability in oku.asp in Hunkaray Duyuru Scripti allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
AJ HYIP ACME - 'topic_detail.php' SQL Injection
CVE-2008-2532—webappsphp
SQL injection vulnerability in forum/topic_detail.php in AJ Square aj-hyip (aka AJ HYIP Acme) allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
MyBlog 0.9.8 - Insecure Cookie Handling
CVE-2008-4341—webappsphp
add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by s
23RISK
open ↗
Referência
CVE-2010-1308
CVE-2010-1308—
Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read a
43RISK
open ↗
Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' 'HREF' Universal Buffer Overflow
CVE-2009-0174—localwindows
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RISK
open ↗
Referência✓ VexDay Proof
Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite
CVE-2009-0465—remotewindows
The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX
23RISK
open ↗
Referência
CVE-2009-4386
CVE-2009-4386—
SQL injection vulnerability in hotel_tiempolibre_ext.php in Venalsur Booking Centre Booking System for Hotels Group, whe
23RISK
open ↗
Referência
CVE-2009-4434
CVE-2009-4434—
Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbi
23RISK
open ↗
Referência
CVE-2010-0249
CVE-2010-0249HIGHunder attack
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and S
100RISK
open ↗
Referência
CVE-2018-17997
CVE-2018-17997—
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
23RISK
open ↗
Referência
CVE-2015-2528
CVE-2015-2528—
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper
23RISK
open ↗
Referência
CVE-2018-17997
CVE-2018-17997—
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
23RISK
open ↗
Referência
CVE-2026-86673
CVE-2026-86673MEDIUM
ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
33RISK
open ↗
Referência
CVE-2018-0969
CVE-2018-0969—
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informatio
23RISK
open ↗
Referência
CVE-2025-15690
CVE-2025-15690MEDIUM
Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
33RISK
open ↗
Referência
CVE-2012-3435
CVE-2012-3435—
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
23RISK
open ↗
Referência
CVE-2010-1335
CVE-2010-1335—
Multiple PHP remote file inclusion vulnerabilities in Insky CMS 006-0111, when register_globals is enabled, allow remote
23RISK
open ↗
Referência
CVE-2026-9583
CVE-2026-9583MEDIUM
SourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure
33RISK
open ↗
Referência
CVE-2014-6070
CVE-2014-6070—
Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2014-9581
CVE-2014-9581—
Directory traversal vulnerability in components/filemanager/download.php in Codiad 2.4.3 allows remote attackers to read
23RISK
open ↗
Referência✓ VexDay Proof
phpEventMan 1.0.2 - 'level' Remote File Inclusion
CVE-2007-0702—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpEventMan 1.0.2 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2017-0114
CVE-2017-0114—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2013-4948
CVE-2013-4948—
SQL injection vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
← previouspage 434 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.