Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
22,367 exploits
Referência✓ VexDay Proof
newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
CVE-2008-2340—webappsphp
Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
Smeego 1.0 - 'Cookie lang' Local File Inclusion
CVE-2008-2352—webappsphp
Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Archangel Weblog 0.90.02 - 'post_id' SQL Injection
CVE-2008-2356—webappsphp
SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
HP Software Update - 'Hpufunction.dll 4.0.0.1' Insecure Method
CVE-2008-2390—remotewindows
Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows
23RISK
open ↗
Referência✓ VexDay Proof
TAGWORX.CMS 3.00.02 - Multiple SQL Injections
CVE-2008-2394—webappsphp
Multiple SQL injection vulnerabilities in TAGWORX.CMS 3.00.02 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2026-12906
CVE-2026-12906LOW
RTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title Disclosure
28RISK
open ↗
Referência
CVE-2026-15749
CVE-2026-15749MEDIUM
mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
33RISK
open ↗
Referência
CVE-2026-58475
CVE-2026-58475MEDIUM
Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
33RISK
open ↗
Referência
CVE-2026-11563
CVE-2026-11563CRITICAL
Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal
48RISK
open ↗
Referência
CVE-2025-15665
CVE-2025-15665MEDIUM
BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field
33RISK
open ↗
Referência
CVE-2026-15622
CVE-2026-15622MEDIUM
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
33RISK
open ↗
Referência
CVE-2026-15607
CVE-2026-15607MEDIUM
tanstack db Alias Path select.ts select prototype pollution
33RISK
open ↗
Referência
CVE-2026-62239
CVE-2026-62239MEDIUM
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
33RISK
open ↗
Referência
CVE-2026-15546
CVE-2026-15546MEDIUM
Shibby Tomato start_jffs2 sub_2D568 os command injection
33RISK
open ↗
Referência
CVE-2026-15545
CVE-2026-15545HIGH
Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write
41RISK
open ↗
Referência
CVE-2026-15544
CVE-2026-15544HIGH
Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow
41RISK
open ↗
Referência
CVE-2026-12397
CVE-2026-12397MEDIUM
WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR
33RISK
open ↗
Referência
CVE-2026-15535
CVE-2026-15535MEDIUM
AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization
33RISK
open ↗
Referência
CVE-2026-15531
CVE-2026-15531MEDIUM
yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization
33RISK
open ↗
Referência
CVE-2026-15530
CVE-2026-15530MEDIUM
WuzhiCMS Attachment API index.php listimage information disclosure
33RISK
open ↗
Referência✓ VexDay Proof
smeweb 1.4b - SQL Injection / Cross-Site Scripting
CVE-2008-2652—webappsphp
Multiple SQL injection vulnerabilities in catalog.php in SMEWeb 1.4b and 1.4f allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
pNews 2.08 - 'shownews' SQL Injection
CVE-2008-2673—webappsphp
SQL injection vulnerability in index.php in Powie pNews 2.08 and 2.10, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component iJoomla! News Portal 1.0 - 'itemID' SQL Injection
CVE-2008-2676—webappsphp
SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows re
23RISK
open ↗
Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
CVE-2008-2677—webappsphp
Cross-site scripting (XSS) vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
1Book Guestbook Script 1.0.1 - Code Execution
CVE-2008-2638—webappsphp
Static code injection vulnerability in guestbook.php in 1Book 1.0.1 and earlier allows remote attackers to upload arbitr
23RISK
open ↗
Referência✓ VexDay Proof
mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
CVE-2008-2647—webappsphp
SQL injection vulnerability in admin/journal_change_mask.inc.php in meBiblio 0.4.7 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload
CVE-2008-2650—webappsphp
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote a
43RISK
open ↗
Referência✓ VexDay Proof
realm CMS 2.3 - Multiple Vulnerabilities
CVE-2008-2680—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in _db/compact.asp in Realm CMS 2.3 and earlier allow remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities
CVE-2008-2684—remotewindows
The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite
CVE-2008-2686—webappsphp
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overw
23RISK
open ↗
← previouspage 475 / 746next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.