Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência✓ VexDay Proof

PHPmyGallery 1.0beta2 - Local/Remote File Inclusion

CVE-2008-6315—webappsphp

PHP remote file inclusion vulnerability in _conf/core/common-tpl-vars.php in PHPmyGallery 1.0 beta2 allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

CMSbright - 'id_rub_page' SQL Injection

CVE-2008-6991—webappsphp

SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

PHPRunner 4.2 - 'SearchOption' Blind SQL Injection

CVE-2009-0963—webappsphp

Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2010-1346

CVE-2010-1346—

SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Teraway LiveHelp 2.0 - Insecure Cookie Handling

CVE-2009-1618—webappsphp

Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&us

23RISK

open ↗

Referência

CVE-2009-2393

CVE-2009-2393—

admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remo

23RISK

open ↗

Referência

CVE-2010-1363

CVE-2010-1363—

SQL injection vulnerability in the JProjects (com_j-projects) component for Joomla! allows remote attackers to execute a

23RISK

open ↗

Referência

CVE-2018-13108

CVE-2018-13108—

All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit

23RISK

open ↗

Referência

CVE-2013-10049

CVE-2013-10049CRITICAL

Raidsonic NAS Devices Unauthenticated Remote Command Execution

63RISK

open ↗

Referência

CVE-2013-10049

CVE-2013-10049CRITICAL

Raidsonic NAS Devices Unauthenticated Remote Command Execution

63RISK

open ↗

Referência

CVE-2013-10049

CVE-2013-10049CRITICAL

Raidsonic NAS Devices Unauthenticated Remote Command Execution

63RISK

open ↗

Referência

CVE-2013-10049

CVE-2013-10049CRITICAL

Raidsonic NAS Devices Unauthenticated Remote Command Execution

63RISK

open ↗

Referência

CVE-2020-26567

CVE-2020-26567—

An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed

28RISK

open ↗

Referência

CVE-2018-6373

CVE-2018-6373—

SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.

23RISK

open ↗

Referência✓ VexDay Proof

Yahoo! Messenger Webcam 8.1 - ActiveX Remote Buffer Overflow (2)

CVE-2007-3148—remotewindows

Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows

28RISK

open ↗

Referência

CVE-2016-0168

CVE-2016-0168—

GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

35RISK

open ↗

Referência

CVE-2007-6289

CVE-2007-6289—

Multiple PHP remote file inclusion vulnerabilities in SerWeb 2.0.0 dev1 and earlier allow remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2017-14838

CVE-2017-14838—

TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.

23RISK

open ↗

Referência✓ VexDay Proof

Exodus 0.10 - URI Handler Arbitrary Parameter Injection (2)

CVE-2008-6935—remotewindows

Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, over

23RISK

open ↗

Referência✓ VexDay Proof

IntelliTamper 2.07/2.08 Beta 4 - A HREF Remote Buffer Overflow

CVE-2008-3360—remotewindows

Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência

CVE-2008-6103

CVE-2008-6103—

PHP remote file inclusion vulnerability in index.php in A4Desk Event Calendar, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência

CVE-2009-4315

CVE-2009-4315—

Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows re

23RISK

open ↗

Referência

CVE-2009-5090

CVE-2009-5090—

SQL injection vulnerability in editcomments.php in Bloggeruniverse Beta 2, when magic_quotes_gpc is disabled, allows rem

23RISK

open ↗

Referência

CVE-2010-4749

CVE-2010-4749—

Multiple cross-site scripting (XSS) vulnerabilities in BLOG:CMS 4.2.1.e, and possibly earlier, allow remote attackers to

23RISK

open ↗

Referência

CVE-2010-4894

CVE-2010-4894—

SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2015-1477

CVE-2015-1477—

SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

webSPELL 4.2.0c - Bypass BBCode Cross-Site Scripting Cookie Stealing

CVE-2009-1408—webappsphp

Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HT

23RISK

open ↗

Referência

CVE-2010-1715

CVE-2010-1715—

Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joom

38RISK

open ↗

Referência

Sentrifugo 3.2 - Persistent Cross-Site Scripting

CVE-2019-15814—webappsphp

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or

23RISK

open ↗

Referência

CVE-2026-13566

CVE-2026-13566MEDIUM

SourceCodester Class and Exam Timetabling System preview3.php sql injection

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.