Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
PHP Director 0.21 - Remote Command Execution
CVE-2009-0604—webappsphp
SQL injection vulnerability in index.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
EZ-Blog Beta2 - 'category' SQL Injection
CVE-2009-1626—webappsphp
SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magic_quotes_gpc is disabled,
23RISK
open ↗
Referência
CVE-2010-2714
CVE-2010-2714—
SQL injection vulnerability in photos/index.php in TCW PHP Album 1.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2010-4917
CVE-2010-4917—
SQL injection vulnerability in sources/search.php in A-Blog 2.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2010-4926
CVE-2010-4926—
SQL injection vulnerability in the TimeTrack (com_timetrack) component 1.2.4 for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2012-2923
CVE-2012-2923—
SQL injection vulnerability in news.php4 in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Relative Real Estate Systems 3.0 - 'listing_id' SQL Injection
CVE-2008-3185—webappsphp
SQL injection vulnerability in index.php in Relative Real Estate Systems 3.0 and earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2026-18895
CVE-2026-18895HIGH
UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow
41RISK
open ↗
Referência
CVE-2010-4808
CVE-2010-4808—
SQL injection vulnerability in index.php in Webmatic allows remote attackers to execute arbitrary SQL commands via the p
23RISK
open ↗
Referência
CVE-2012-2908
CVE-2012-2908—
Multiple SQL injection vulnerabilities in admin/bbcodes.php in Viscacha 0.8.1.1 allow remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
jetAudio 7.x - '.m3u' Local Overwrite (SEH)
CVE-2007-5487—localwindows
Stack-based buffer overflow in COWON America jetAudio Basic 7.0.3 allows user-assisted remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2010-2744
CVE-2010-2744—
The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows
23RISK
open ↗
Referência
CVE-2010-4993
CVE-2010-4993—
SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2012-0935
CVE-2012-0935—
SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2010-5083
CVE-2010-5083—
SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2024-22901
CVE-2024-22901CRITICAL
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
48RISK
open ↗
Referência
CVE-2011-4672
CVE-2011-4672—
Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
CVE-2025-25257CRITICALunder attackwebappsmultiple
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
Referência
CVE-2017-13795
CVE-2017-13795—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2026-66748
CVE-2026-66748HIGH
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
41RISK
open ↗
Referência
CVE-2026-103330
CVE-2026-103330MEDIUM
Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
33RISK
open ↗
Referência
CVE-2025-15047
CVE-2025-15047CRITICAL
Tenda WH450 HTTP Request PPTPDClient stack-based overflow
48RISK
open ↗
Referência
CVE-2025-15047
CVE-2025-15047CRITICAL
Tenda WH450 HTTP Request PPTPDClient stack-based overflow
48RISK
open ↗
Referência
CVE-2023-0830
CVE-2023-0830MEDIUM
EasyNAS backup.pl system os command injection
38RISK
open ↗
Referência
CVE-2026-100896
CVE-2026-100896CRITICAL
TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection
48RISK
open ↗
Referência
CVE-2026-66748
CVE-2026-66748HIGH
Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field
41RISK
open ↗
Referência
CVE-2026-103313
CVE-2026-103313MEDIUM
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
33RISK
open ↗
Referência
CVE-2012-5320
CVE-2012-5320—
Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to
23RISK
open ↗
Referência
CVE-2012-6508
CVE-2012-6508—
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hija
23RISK
open ↗
Referência
CVE-2014-9642
CVE-2014-9642—
bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows loca
23RISK
open ↗
← previouspage 467 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.