Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,301 exploits
Referência
CVE-2012-4240
SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authentic
23RISK
open ↗Referência✓ VexDay Proof
BrewBlogger 1.3.1 - 'printLog.php' SQL Injection
SQL injection vulnerability in printLog.php in BrewBlogger (BB) 1.3.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência
CVE-2009-3348
Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or
23RISK
open ↗Referência✓ VexDay Proof
OpenLD 1.2.2 - 'index.php?id' SQL Injection
SQL injection vulnerability in index.php in OpenLD 1.2.2 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2018-4863
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKE
23RISK
open ↗Referência✓ VexDay Proof
AdaptCMS Lite 1.3 - Blind SQL Injection
SQL injection vulnerability in the "Check User" feature (includes/check_user.php) in AdaptCMS Lite and AdaptCMS Pro 1.3
23RISK
open ↗Referência
CVE-2009-3755
Multiple cross-site scripting (XSS) vulnerabilities in phpBMS 0.96 allow remote attackers to inject arbitrary web script
23RISK
open ↗Referência
CVE-2010-2611
SQL injection vulnerability in show_search_result.php in i-netsolution Job Search Engine allows remote attackers to exec
23RISK
open ↗Referência
CVE-2010-2611
SQL injection vulnerability in show_search_result.php in i-netsolution Job Search Engine allows remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection
Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary
23RISK
open ↗Referência
CVE-2017-11120
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
23RISK
open ↗Referência
CVE-2026-60009
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every
41RISK
open ↗Referência
CVE-2011-4801
SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authenticati
23RISK
open ↗Referência
CVE-2021-43326
Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
23RISK
open ↗Referência
CVE-2014-10015
SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
Frogss CMS 0.7 - SQL Injection
Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2020-8425
Cups Easy (Purchase & Inventory) 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php.
23RISK
open ↗Referência
CVE-2017-1000409
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environ
23RISK
open ↗Referência
CVE-2012-1911
Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
Tiger PHP News System 1.0b build 39 - SQL Injection
SQL injection vulnerability in index.php in Tiger Php News System (TPNS) 1.0b and earlier allows remote attackers to exe
23RISK
open ↗Referência✓ VexDay Proof
eXV2 Module bamaGalerie 3.03 - SQL Injection
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RISK
open ↗Referência✓ VexDay Proof
phpBP RC3 (2.204) FIX4 - SQL Injection
SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attack
23RISK
open ↗Referência
CVE-2010-2618
PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is ena
23RISK
open ↗Referência✓ VexDay Proof
Autodealers CMS AutOnline - 'pageid' SQL Injection
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
D-iscussion Board 3.01 - 'topic' Local File Inclusion
Directory traversal vulnerability in index.php in D-iscussion Board 3.01 allows remote attackers to read arbitrary files
23RISK
open ↗Referência✓ VexDay Proof
Brim 2.0.0 - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in the Tasks plugin in Brim 2.0.0, when magic_quotes_gpc is disabled, allows remote authenti
23RISK
open ↗Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web
23RISK
open ↗Referência✓ VexDay Proof
Katalog Plyt Audio (pl) 1.0 - SQL Injection
SQL injection vulnerability in index.php in Katalog Plyt Audio 1.0 and earlier allows remote attackers to execute arbitr
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.