Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência✓ VexDay Proof
FreeBSD mcweject 0.9 'Eject' - Local Buffer Overflow / Local Privilege Escalation
CVE-2007-1719—localbsd
Buffer overflow in eject.c in Jason W. Bacon mcweject 0.9 on FreeBSD, and possibly other versions, allows local users to
23RISK
open ↗
Referência✓ VexDay Proof
wolioCMS - Authentication Bypass / SQL Injection
CVE-2007-4156—webappsphp
Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the
23RISK
open ↗
Referência✓ VexDay Proof
Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Command Execution
CVE-2008-4049—remotewindows
A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remot
23RISK
open ↗
Referência
CVE-2015-4119
CVE-2015-4119—
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2014-4194
CVE-2014-4194—
SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-15035
CVE-2026-15035MEDIUM
bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection
33RISK
open ↗
Referência
CVE-2020-29168
CVE-2020-29168CRITICAL
SQL Injection vulnerability in Projectworlds Online Doctor Appointment Booking System, allows attackers to gain sensitiv
48RISK
open ↗
Referência
CVE-2017-11165
CVE-2017-11165—
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a d
50RISK
open ↗
Referência✓ VexDay Proof
Jupiter CMS 1.1.5 - 'Client-IP' SQL Injection
CVE-2007-0971—webappsphp
Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2013-3729
CVE-2013-3729—
Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hija
23RISK
open ↗
Referência
CVE-2009-4864
CVE-2009-4864—
Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Scrip
23RISK
open ↗
Referência
CVE-2026-14722
CVE-2026-14722MEDIUM
tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection
33RISK
open ↗
Referência
CVE-2009-2424
CVE-2009-2424—
Cross-site scripting (XSS) vulnerability in search.php in Ebay Clone 2009 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2026-86839
CVE-2026-86839LOW
Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
28RISK
open ↗
Referência
CVE-2010-2689
CVE-2010-2689—
SQL injection vulnerability in cont_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2013-5730
CVE-2013-5730—
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DSL-2740B Gateway with firmware EU_1.00 allow remot
23RISK
open ↗
Referência
CVE-2026-81655
CVE-2026-81655HIGH
Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields
41RISK
open ↗
Referência✓ VexDay Proof
FlashGameScript 1.7 - 'user' SQL Injection
CVE-2007-3646—webappsphp
SQL injection vulnerability in index.php in FlashGameScript 1.7 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
ACG News 1.0 - 'aid'/'catid' SQL Injection
CVE-2007-4603—webappsphp
Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2026-105777
CVE-2026-105777MEDIUM
Insertion of Sensitive Information Into Sent Data in GitLab
33RISK
open ↗
Referência
CVE-2014-10015
CVE-2014-10015—
SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2021-43326
CVE-2021-43326—
Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
23RISK
open ↗
Referência
CVE-2017-1000409
CVE-2017-1000409—
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environ
23RISK
open ↗
Referência
CVE-2017-2935
CVE-2017-2935—
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the F
28RISK
open ↗
Referência✓ VexDay Proof
Frogss CMS 0.7 - SQL Injection
CVE-2007-2299—webappsphp
Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.0 Member_Space Module - SQL Injection
CVE-2007-4956—webappsphp
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗
Referência✓ VexDay Proof
eXV2 Module bamaGalerie 3.03 - SQL Injection
CVE-2008-1349—webappsphp
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RISK
open ↗
Referência
CVE-2011-4801
CVE-2011-4801—
SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authenticati
23RISK
open ↗
Referência
CVE-2012-1911
CVE-2012-1911—
Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
phpBP RC3 (2.204) FIX4 - SQL Injection
CVE-2008-1408—webappsphp
SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attack
23RISK
open ↗
← previouspage 472 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.