Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,166cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,078VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência✓ VexDay Proof

study planner (studiewijzer) 0.15 - Remote File Inclusion

CVE-2007-1628—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globa

23RISK

open ↗

Referência

CVE-2011-4066

CVE-2011-4066—

SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

FreeCMS.us 0.2 - 'index.php' SQL Injection

CVE-2008-2796—webappsphp

SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência

CVE-2014-8674

CVE-2014-8674—

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc

23RISK

open ↗

Referência

CVE-2014-8674

CVE-2014-8674—

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc

23RISK

open ↗

Referência

CVE-2017-17872

CVE-2017-17872—

The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.

23RISK

open ↗

Referência

CVE-2012-6516

CVE-2012-6516—

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência✓ VexDay Proof

mystats - 'hits.php' Multiple Vulnerabilities

CVE-2008-4644—webappsphp

hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H

23RISK

open ↗

Referência✓ VexDay Proof

ClanLite 2.x - SQL Injection / Cross-Site Scripting

CVE-2008-5215—webappsphp

SQL injection vulnerability in service/profil.php in ClanLite 2.2006.05.20 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

ravennuke 2.3.0 - Multiple Vulnerabilities

CVE-2009-0673—webappsphp

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3

23RISK

open ↗

Referência

CVE-2010-1535

CVE-2010-1535—

Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers

43RISK

open ↗

Referência

CVE-2026-16940

CVE-2026-16940CRITICAL

Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal

48RISK

open ↗

Referência

CVE-2026-90623

CVE-2026-90623MEDIUM

andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation

33RISK

open ↗

Referência

CVE-2017-14738

CVE-2017-14738—

FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize in

23RISK

open ↗

Referência

CVE-2017-9813

CVE-2017-9813—

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptNa

23RISK

open ↗

Referência

CVE-2019-11375

CVE-2019-11375—

Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.

23RISK

open ↗

Referência

CVE-2019-11375

CVE-2019-11375—

Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.

23RISK

open ↗

Referência

CVE-2020-8778

CVE-2020-8778—

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document,

23RISK

open ↗

Referência

CVE-2026-73481

CVE-2026-73481MEDIUM

phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

33RISK

open ↗

Referência

CVE-2026-90622

CVE-2026-90622MEDIUM

GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference

33RISK

open ↗

Referência✓ VexDay Proof

Philex 0.2.3 - Remote File Inclusion / File Disclosure

CVE-2007-1698—webappsphp

download.php in Philex 0.2.3 and earlier allows remote attackers to read arbitrary files and source code, and obtain sen

23RISK

open ↗

Referência✓ VexDay Proof

Noticeware Email Server 4.6.1.0 - Denial of Service

CVE-2008-1713—doswindows

MailServer.exe in NoticeWare Email Server 4.6.1.0 allows remote attackers to cause a denial of service (application cras

23RISK

open ↗

Referência✓ VexDay Proof

Scientific Image DataBase 0.41 - Blind SQL Injection

CVE-2008-2834—webappsphp

SQL injection vulnerability in projects.php in Scientific Image DataBase 0.41 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection

CVE-2008-5320—webappsphp

SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute

23RISK

open ↗

Referência

CVE-2015-2084

CVE-2015-2084—

Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote

23RISK

open ↗

Referência

CVE-2017-9813

CVE-2017-9813—

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptNa

23RISK

open ↗

Referência✓ VexDay Proof

Online Grades 3.2.4 - Authentication Bypass

CVE-2009-0453—webappsphp

Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, whi

23RISK

open ↗

Referência✓ VexDay Proof

Orbit Downloader 2.8.7 - Arbitrary File Deletion

CVE-2009-1064—remotewindows

Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allow

23RISK

open ↗

Referência

CVE-2009-4991

CVE-2009-4991—

Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to

23RISK

open ↗

Referência

CVE-2010-0764

CVE-2010-0764—

SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.