Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2026-58377

CVE-2026-58377HIGH

JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys

41RISK

open ↗

Referência

CVE-2016-5195

CVE-2016-5195HIGHunder attack

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

open ↗

Referência✓ VexDay Proof

McGallery 0.5b - 'download.php' Arbitrary File Download

CVE-2007-1478—webappsphp

download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the fil

23RISK

open ↗

Referência✓ VexDay Proof

PBLang 4.67.16.a - Remote Code Execution

CVE-2007-3096—webappsphp

Directory traversal vulnerability in login.php in PBLang (PBL) 4.67.16.a and earlier, when magic_quotes_gpc is disabled,

23RISK

open ↗

Referência✓ VexDay Proof

Evilsentinel 1.0.9 - Multiple Vulnerabilities Disable

CVE-2008-0350—webappsphp

admin/index.php in Evilsentinel 1.0.9 and earlier sends a redirect to the web browser but does not exit, which allows re

23RISK

open ↗

Referência✓ VexDay Proof

freePHPgallery 0.6 - Cookie Local File Inclusion

CVE-2008-0818—webappsphp

Multiple directory traversal vulnerabilities in freePHPgallery 0.6 allow remote attackers to include and execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Alstrasoft AskMe Pro 2.1 - Multiple SQL Injections

CVE-2008-2902—webappsphp

SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute ar

23RISK

open ↗

Referência✓ VexDay Proof

PHP Crawler 0.8 - Remote File Inclusion

CVE-2008-4137—webappsphp

PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PH

23RISK

open ↗

Referência✓ VexDay Proof

Fuzzylime CMS 3.03 - 'track.php' Local File Inclusion

CVE-2008-5291—webappsphp

Directory traversal vulnerability in code/track.php in FuzzyLime 3.03 allows remote attackers to include and execute arb

23RISK

open ↗

Referência✓ VexDay Proof

IntelliTamper 2.07/2.08 - '.map' Local Overwrite (SEH)

CVE-2008-5755—localwindows

Stack-based buffer overflow in IntelliTamper 2.07 and 2.08 allows remote attackers to execute arbitrary code via a MAP f

23RISK

open ↗

Referência✓ VexDay Proof

OpenForum 0.66 Beta - Remote Reset Admin Password

CVE-2008-7066—webappsphp

OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct req

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_bookJoomlas 0.1 - SQL Injection

CVE-2009-1263—webappsphp

SQL injection vulnerability in sub_commententry.php in the BookJoomlas (com_bookjoomlas) component 0.1 for Joomla! allow

23RISK

open ↗

Referência

CVE-2009-3317

CVE-2009-3317—

PHP remote file inclusion vulnerability in pages/pageHeader.php in OpenSiteAdmin 0.9.7 BETA allows remote attackers to e

23RISK

open ↗

Referência

CVE-2018-7198

CVE-2018-7198—

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.

23RISK

open ↗

Referência

CVE-2026-101859

CVE-2026-101859MEDIUM

RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

33RISK

open ↗

Referência

CVE-2018-9092

CVE-2018-9092—

There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.

23RISK

open ↗

Referência

CVE-2013-10040

CVE-2013-10040CRITICAL

ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE

63RISK

open ↗

Referência

CVE-2013-10040

CVE-2013-10040CRITICAL

ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE

63RISK

open ↗

Referência✓ VexDay Proof

Joomla! / Mambo Component Taskhopper 1.1 - Remote File Inclusion

CVE-2007-2005—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the Taskhopper 1.1 component for Mambo and Joomla! allow remote at

23RISK

open ↗

Referência

CVE-2017-15730

CVE-2017-15730—

In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.

23RISK

open ↗

Referência

CVE-2017-17615

CVE-2017-17615—

Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.

23RISK

open ↗

Referência

CVE-2014-9243

CVE-2014-9243—

Multiple cross-site scripting (XSS) vulnerabilities in WebsiteBaker 2.8.3 allow remote attackers to inject arbitrary web

23RISK

open ↗

Referência

CVE-2026-101858

CVE-2026-101858MEDIUM

RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection

33RISK

open ↗

Referência✓ VexDay Proof

iScripts Socialware - 'id' SQL Injection

CVE-2008-1772—webappsphp

iScripts SocialWare stores passwords in cleartext in a database, which allows context-dependent attackers to obtain sens

23RISK

open ↗

Referência

CVE-2017-17615

CVE-2017-17615—

Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.

23RISK

open ↗

Referência✓ VexDay Proof

BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection

CVE-2008-3784—webappsphp

SQL injection vulnerability in scrape.php in BtiTracker 1.4.7 and earlier and xBtiTracker 2.0.542 and earlier allows rem

23RISK

open ↗

Referência

CVE-2012-2940

CVE-2012-2940—

MediaChance Real-DRAW PRO 5.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted (

23RISK

open ↗

Referência

CVE-2012-5228

CVE-2012-5228—

Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions befo

23RISK

open ↗

Referência

CVE-2013-6058

CVE-2013-6058—

SQL injection vulnerability in appRain CMF 3.0.2 and earlier allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2010-5289

CVE-2010-5289—

Buffer overflow in the Authenticate method in the INCREDISPOOLERLib.Pop ActiveX control in ImSpoolU.dll in IncrediMail 2

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.