Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits

35,607CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecent popular risk

22,407 exploits

Referência✓ VexDay Proof

Pligg 9.9.5b - Arbitrary File Upload / SQL Injection

CVE-2008-5739—webappsphp

SQL injection vulnerability in evb/check_url.php in Pligg CMS 9.9.5 Beta allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2014-4741

CVE-2014-4741—

SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2014-9242

CVE-2014-9242—

SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2011-4026

CVE-2011-4026—

SQL injection vulnerability in thanks.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

PHPEasyData Pro 2.2.2 - 'index.php' SQL Injection

CVE-2006-5707—webappsphp

SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2023-31903

CVE-2023-31903CRITICAL

GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by u

48RISK

open ↗

Referência

CVE-2020-17382

CVE-2020-17382—

The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).

23RISK

open ↗

Referência✓ VexDay Proof

ClickAuction - Authentication Bypass

CVE-2009-0297—webappsphp

SQL injection vulnerability in login_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

AuraCMS 2.1 - Remote File Attachment / Local File Inclusion

CVE-2007-4886—webappsphp

Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2013-7043

CVE-2013-7043—

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2

23RISK

open ↗

Referência✓ VexDay Proof

WebSihirbazi 5.1.1 - 'pageid' SQL Injection

CVE-2007-6556—webappsphp

Multiple SQL injection vulnerabilities in websihirbazi 5.1.1 allow remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2016-9091

CVE-2016-9091—

Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 and Content Analysis System (CAS) 1.3 before 1.3.7.4 are susc

28RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mediaslide - 'albumnum' Blind SQL Injection

CVE-2008-0802—webappsphp

SQL injection vulnerability in index.php in the MediaSlide (com_mediaslide) 0.5 component for Joomla! allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Acajoom 1.1.5 - SQL Injection

CVE-2008-1427—webappsphp

SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

bilboblog 2.1 - Multiple Vulnerabilities

CVE-2008-3301—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inje

23RISK

open ↗

Referência

CVE-2013-6275

CVE-2013-6275—

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

23RISK

open ↗

Referência✓ VexDay Proof

CMS Ortus 1.13 - SQL Injection

CVE-2008-6282—webappsphp

SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated

23RISK

open ↗

Referência

CVE-2020-8839

CVE-2020-8839—

Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cg

23RISK

open ↗

Referência

CVE-2018-10078

CVE-2018-10078—

Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to i

23RISK

open ↗

Referência✓ VexDay Proof

3editor CMS 0.42 - 'index.php' Local File Inclusion

CVE-2006-6877—webappsphp

Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register_globals i

23RISK

open ↗

Referência

CVE-2010-2036

CVE-2010-2036—

Directory traversal vulnerability in the Percha Fields Attach (com_perchafieldsattach) component 1.x for Joomla! allows

43RISK

open ↗

Referência

CVE-2026-4170

CVE-2026-4170CRITICAL

Topsec TopACM HTTP Request nmc_sync.php os command injection

48RISK

open ↗

Referência✓ VexDay Proof

F3Site 2.1 - Remote Code Execution

CVE-2007-0764—webappsphp

Unrestricted file upload vulnerability in F3Site 2.1 and earlier allows remote authenticated administrators to upload an

23RISK

open ↗

Referência✓ VexDay Proof

e107 < 0.7.8 - 'photograph' Arbitrary File Upload

CVE-2007-3429—webappsphp

Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allow

23RISK

open ↗

Referência✓ VexDay Proof

Vivvo CMS 3.4 - 'index.php' Blind SQL Injection

CVE-2007-3939—webappsphp

SQL injection vulnerability in index.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) CMS 3.4 and earlie

23RISK

open ↗

Referência

CVE-2017-15963

CVE-2017-15963—

iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser pa

23RISK

open ↗

Referência✓ VexDay Proof

lustig.cms Beta 2.5 - 'forum.php?view' Remote File Inclusion

CVE-2007-5138—webappsphp

PHP remote file inclusion vulnerability in forum/forum.php in lustig.cms BETA 2.5 allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

phpFaber URLInn 2.0.5 - 'dir_ws' Remote File Inclusion

CVE-2007-5754—webappsphp

PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

CaupoShop Pro 2.x - 'action' Remote File Inclusion

CVE-2007-5784—webappsphp

PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary P

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! / Mambo Component rsgallery 2.0b5 - 'catid' SQL Injection

CVE-2007-6362—webappsphp

SQL injection vulnerability in index.php in the RSGallery (com_rsgallery) 2.0 beta 5 and earlier component for Mambo and

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.