Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2017-7952
CVE-2017-7952—
INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter.
23RISK
open ↗
Referência
CVE-2026-81766
CVE-2026-81766MEDIUM
Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin
33RISK
open ↗
Referência✓ VexDay Proof
PHPKIT 1.6.4pl1 - 'article.php' SQL Injection
CVE-2007-6134—webappsphp
SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-82017
CVE-2026-82017HIGH
IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area
41RISK
open ↗
Referência
CVE-2026-111979
CVE-2026-111979MEDIUM
GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
33RISK
open ↗
Referência
CVE-2026-111978
CVE-2026-111978MEDIUM
GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
33RISK
open ↗
Referência
CVE-2010-3131
CVE-2010-3131—
Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 an
28RISK
open ↗
Referência✓ VexDay Proof
deeemm CMS (dmcms) 0.7.4 - Multiple Vulnerabilities
CVE-2008-3720—webappsphp
SQL injection vulnerability in index.php in DeeEmm CMS (DMCMS) 0.7.4 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
MyCard 1.0.2 - 'id' SQL Injection
CVE-2008-4738—webappsphp
SQL injection vulnerability in gallery.php in MyCard 1.0.2 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2008-5638
CVE-2008-5638—
Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
ASPSiteWare Home Builder 1.0/2.0 - SQL Injection
CVE-2008-5774—webappsasp
Multiple SQL injection vulnerabilities in ASPSiteWare HomeBuilder 1.0 and 2.0 allow remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2015-3202
CVE-2015-3202—
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as ro
23RISK
open ↗
Referência✓ VexDay Proof
AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
CVE-2008-7044—webappsphp
SQL injection vulnerability in admin/include/newpoll.php in AJ Square Free Polling Script (AJPoll) Database version allo
23RISK
open ↗
Referência
CVE-2014-8727
CVE-2014-8727—
Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrat
23RISK
open ↗
Referência
CVE-2009-2586
CVE-2009-2586—
Cross-site scripting (XSS) vulnerability in articles.php in EDGEPHP EZArticles allows remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2015-3202
CVE-2015-3202—
fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as ro
23RISK
open ↗
Referência
CVE-2009-4206
CVE-2009-4206—
SQL injection vulnerability in admin.link.modify.php in Million Dollar Text Links 1.0 and earlier allows remote attacker
23RISK
open ↗
Referência
CVE-2009-4221
CVE-2009-4221—
SQL injection vulnerability in classified.php in phpBazar 2.1.1fix and earlier allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2014-8727
CVE-2014-8727—
Multiple directory traversal vulnerabilities in F5 BIG-IP before 10.2.2 allow local users with the "Resource Administrat
23RISK
open ↗
Referência
CVE-2026-9414
CVE-2026-9414MEDIUM
SourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-90599
CVE-2026-90599MEDIUM
Rizwan17 inventory-management-system process.php cross-site request forgery
33RISK
open ↗
Referência
CVE-2026-9379
CVE-2026-9379MEDIUM
Edimax BR-6675nD POST Request formWpsStart command injection
33RISK
open ↗
Referência
CVE-2026-91993
CVE-2026-91993MEDIUM
Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list
33RISK
open ↗
Referência
CVE-2026-9582
CVE-2026-9582MEDIUM
SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery
33RISK
open ↗
Referência✓ VexDay Proof
project alumni 1.0.9 - 'index.php?act' Local File Inclusion
CVE-2007-6184—webappsphp
Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute ar
23RISK
open ↗
Referência
CVE-2026-9580
CVE-2026-9580MEDIUM
JeecgBoot selectDepart LoginController.selectDepart access control
33RISK
open ↗
Referência
CVE-2026-91002
CVE-2026-91002MEDIUM
stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication
33RISK
open ↗
Referência
CVE-2010-4842
CVE-2010-4842—
SQL injection vulnerability in admin/login.php in MHP DownloadScript (aka MH Products Download Center) 2.2 allows remote
23RISK
open ↗
Referência
CVE-2016-1807
CVE-2016-1807—
Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watch
23RISK
open ↗
Referência
CVE-2026-66004
CVE-2026-66004MEDIUM
BlenderMCP Path Traversal via download_polyhaven_asset API
33RISK
open ↗
← previouspage 497 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.