Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2014-9642
CVE-2014-9642—
bdagent.sys in BullGuard Antivirus, Internet Security, Premium Protection, and Online Backup before 15.0.288 allows loca
23RISK
open ↗
Referência✓ VexDay Proof
PHP Project Management 0.8.10 - Multiple Local/Remote File Inclusions
CVE-2007-5641—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers t
35RISK
open ↗
Referência
CVE-2016-10045
CVE-2016-10045—
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
60RISK
open ↗
Referência
CVE-2016-10045
CVE-2016-10045—
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
60RISK
open ↗
Referência✓ VexDay Proof
ECShop 2.5.0 - 'order_sn' SQL Injection
CVE-2009-1622—webappsphp
SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência
CVE-2009-3313
CVE-2009-3313—
Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2010-5060
CVE-2010-5060—
SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-5285
CVE-2010-5285—
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the a
23RISK
open ↗
Referência
CVE-2012-5342
CVE-2012-5342—
Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2017-14097
CVE-2017-14097—
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below coul
28RISK
open ↗
Referência
CVE-2017-6805
CVE-2017-6805—
Directory traversal vulnerability in the TFTP server in MobaXterm Personal Edition 9.4 allows remote attackers to read a
23RISK
open ↗
Referência
CVE-2026-103688
CVE-2026-103688CRITICAL
Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2026-103382
CVE-2026-103382MEDIUM
Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation
33RISK
open ↗
Referência
CVE-2022-3915
CVE-2022-3915CRITICAL
Dokan < 3.7.6 - Unauthenticated SQLi
48RISK
open ↗
Referência✓ VexDay Proof
Mambo Component MamboWiki 0.9.6 - Remote File Inclusion
CVE-2006-4282—webappsphp
PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier f
23RISK
open ↗
Referência✓ VexDay Proof
InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion
CVE-2007-5674—webappsphp
Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is
23RISK
open ↗
Referência
CVE-2010-4872
CVE-2010-4872—
SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2026-14752
CVE-2026-14752MEDIUM
mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting
33RISK
open ↗
Referência
CVE-2016-1011
CVE-2016-1011—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows
28RISK
open ↗
Referência
CVE-2016-1013
CVE-2016-1013—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows
28RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component jooget 2.6.8 - SQL Injection
CVE-2008-0829—webappsphp
SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo
23RISK
open ↗
Referência✓ VexDay Proof
EQdkp 1.3.2f - 'user_id' Authentication Bypass
CVE-2008-2222—webappsphp
SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via
23RISK
open ↗
Referência✓ VexDay Proof
Link Bid Script 1.5 - Multiple SQL Injections
CVE-2008-4175—webappsphp
Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2010-2853
CVE-2010-2853—
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2026-14751
CVE-2026-14751MEDIUM
mjperpinosa stumasy search_scratch_data.php search_scratch_data sql injection
33RISK
open ↗
Referência✓ VexDay Proof
FlashGet 1.9.0.1012 - 'FTP PWD Response' SEH Stack Overflow
CVE-2008-4321—remotewindows
Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res
23RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2156—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to in
23RISK
open ↗
Referência
CVE-2010-2853
CVE-2010-2853—
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2023-1934
CVE-2023-1934CRITICAL
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL
48RISK
open ↗
Referência
CVE-2026-115535
CVE-2026-115535MEDIUM
gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
33RISK
open ↗
← previouspage 492 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.