Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,039cataloged exploits

39,796CVEs with public exploitation

24,695lab-tested

All Referência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecent popular risk

25,629 exploits

Referência

CVE-2026-110810

CVE-2026-110810LOW

ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds

28RISK

open ↗

Referência

CVE-2009-2573

CVE-2009-2573—

Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magic_quotes_gpc is disabled, allow remote authenti

23RISK

open ↗

Referência

CVE-2010-0971

CVE-2010-0971—

Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor pr

23RISK

open ↗

Referência

CVE-2010-0972

CVE-2010-0972—

Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers t

43RISK

open ↗

Referência

CVE-2010-0985

CVE-2010-0985—

Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote atta

43RISK

open ↗

Referência

CVE-2010-2341

CVE-2010-2341—

PHP remote file inclusion vulnerability in system/application/views/public/commentform.php in EZPX Photoblog 1.2 beta al

23RISK

open ↗

Referência

CVE-2026-110809

CVE-2026-110809MEDIUM

sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service

33RISK

open ↗

Referência

CVE-2026-110698

CVE-2026-110698MEDIUM

Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

33RISK

open ↗

Referência✓ VexDay Proof

Specimen Image Database - 'client.php' Remote File Inclusion

CVE-2006-5419—webappsphp

PHP remote file inclusion vulnerability in client.php in University of Glasgow Specimen Image Database (SID), when regis

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Rapid Recipe 1.6.6/1.6.7 - SQL Injection

CVE-2008-2697—webappsphp

SQL injection vulnerability in the Rapid Recipe (com_rapidrecipe) component 1.6.6 and 1.6.7 for Joomla! allows remote at

23RISK

open ↗

Referência✓ VexDay Proof

Galatolo Web Manager 1.0 - Cross-Site Scripting / Local File Inclusion

CVE-2008-2699—webappsphp

Multiple directory traversal vulnerabilities in Galatolo WebManager (GWM) 1.0 allow remote attackers to include and exec

23RISK

open ↗

Referência

CVE-2018-15133

CVE-2018-15133HIGHunder attack

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

100RISK

open ↗

Referência

CVE-2023-38408

CVE-2023-38408CRITICAL

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot

70RISK

open ↗

Referência✓ VexDay Proof

Gforge 4.6 rc1 - 'skill_edit' SQL Injection

CVE-2008-6188—webappsphp

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component VirtueMart Google Base 1.1 - Remote File Inclusion

CVE-2008-6483—webappsphp

PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_go

28RISK

open ↗

Referência✓ VexDay Proof

RevokeBB 1.0 RC11 - 'Search' SQL Injection

CVE-2008-2778—webappsphp

SQL injection vulnerability in inc/class_search.php in the Search System in RevokeBB 1.0 RC11 allows remote attackers to

23RISK

open ↗

Referência

CVE-2010-1050

CVE-2010-1050—

SQL injection vulnerability in index.php in AudiStat 1.3 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2012-4772

CVE-2012-4772—

SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência✓ VexDay Proof

LoCal Calendar 1.1 - 'lcUser.php' Remote File Inclusion

CVE-2006-5426—webappsphp

PHP remote file inclusion vulnerability in lib/lcUser.php in LoCal Calendar System 1.1 remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2018-9160

CVE-2018-9160—

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

60RISK

open ↗

Referência

CVE-2019-15978

CVE-2019-15978HIGH

Cisco Data Center Network Manager Command Injection Vulnerabilities

53RISK

open ↗

Referência

CVE-2012-4773

CVE-2012-4773—

Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack

23RISK

open ↗

Referência

CVE-2014-3791

CVE-2014-3791—

Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 6.8 allows remote attackers to execute arbitrary code

60RISK

open ↗

Referência

CVE-2018-12710

CVE-2018-12710—

An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (whi

45RISK

open ↗

Referência

CVE-2019-6441

CVE-2019-6441—

An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM33

35RISK

open ↗

Referência

CVE-2021-22145

CVE-2021-22145—

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the abil

60RISK

open ↗

Referência✓ VexDay Proof

PHP TV Portal 2.0 - 'mid' SQL Injection

CVE-2008-6285—webappsphp

SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2010-1091

CVE-2010-1091—

Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitra

23RISK

open ↗

Referência

CVE-2010-2691

CVE-2010-2691—

Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2010-2912

CVE-2010-2912—

SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.