Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
22,429 exploits
Referência
CVE-2026-13534
CVE-2026-13534LOW
CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization
28RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Brightcode Weblinks - 'catid' SQL Injection
CVE-2008-3083—webappsphp
SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting
CVE-2008-3088—webappsphp
Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload
CVE-2008-3117—webappsphp
Unrestricted file upload vulnerability in update_profile.php in PHPmotion 2.0 and earlier allows remote authenticated us
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Real Estate Script 1.1 - SQL Injection
CVE-2008-3123—webappsphp
SQL injection vulnerability in index.php in Mole Group Real Estate Script 1.1 and earlier allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Hotel Script 1.0 - SQL Injection
CVE-2008-3124—webappsphp
SQL injection vulnerability in index.php in Mole Group Hotel Script 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Mole Group Last Minute Script 4.0 - SQL Injection
CVE-2008-3125—webappsphp
SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Pivot 1.40.5 - Dreamwind 'load_template()' Credentials Disclosure
CVE-2008-3128—webappsphp
Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência✓ VexDay Proof
Catviz 0.4.0 beta1 - Multiple SQL Injections
CVE-2008-3129—webappsphp
Multiple SQL injection vulnerabilities in index.php in Catviz 0.4 beta 1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-56789
CVE-2026-56789HIGH
RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count
41RISK
open ↗
Referência
CVE-2026-56787
CVE-2026-56787MEDIUM
RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
33RISK
open ↗
Referência
CVE-2026-11998
CVE-2026-11998HIGH
AngularJS XSS via SCE resource URL sanitization bypass
41RISK
open ↗
Referência
CVE-2026-11998
CVE-2026-11998HIGH
AngularJS XSS via SCE resource URL sanitization bypass
41RISK
open ↗
Referência
CVE-2026-50128
CVE-2026-50128MEDIUM
Mastodon: Spoofing of attribution domains
33RISK
open ↗
Referência
CVE-2026-8379
CVE-2026-8379HIGH
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
41RISK
open ↗
Referência
CVE-2026-7842
CVE-2026-7842MEDIUM
Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
33RISK
open ↗
Referência
CVE-2026-12823
CVE-2026-12823MEDIUM
Browserbase Skills Autobrowse Trace Artifact default permission
33RISK
open ↗
Referência
CVE-2026-12814
CVE-2026-12814MEDIUM
Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection
33RISK
open ↗
Referência
CVE-2026-12810
CVE-2026-12810MEDIUM
Edimax BR-6478AC V2 POST Request mp command injection
33RISK
open ↗
Referência✓ VexDay Proof
pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection
CVE-2008-3131—webappsphp
SQL injection vulnerability in chatbox.php in pSys 0.7.0 Alpha, when magic_quotes_gpc is disabled, allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
AShop Deluxe 4.x - 'catalogue.php' SQL Injection
CVE-2008-3136—webappsphp
SQL injection vulnerability in catalogue.php in AShop Deluxe 4.x allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (2)
CVE-2008-3152—webappsphp
SQL injection vulnerability in directory.php in SmartPPC and SmartPPC Pro allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection
CVE-2008-3153—webappsphp
SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwar
23RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.01 - Remote Command Execution
CVE-2008-3165—webappsphp
Directory traversal vulnerability in rss.php in fuzzylime (cms) 3.01a and earlier, when magic_quotes_gpc is disabled, al
23RISK
open ↗
Referência✓ VexDay Proof
ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
CVE-2008-3180—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in upload/file/language_menu.php in ContentNow CMS 1.4.1 allow remot
23RISK
open ↗
Referência✓ VexDay Proof
Download Accelerator Plus DAP 8.x - '.m3u' Local Buffer Overflow
CVE-2008-3182—localwindows
Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow
23RISK
open ↗
Referência
CVE-2026-10873
CVE-2026-10873HIGH
Shibby Tomato Web UI rstats rstats_path os command injection
41RISK
open ↗
Referência
CVE-2026-10872
CVE-2026-10872HIGH
Shibby Tomato Web UI rc start_vpnserver os command injection
41RISK
open ↗
Referência
CVE-2026-10871
CVE-2026-10871HIGH
Shibby Tomato Web UI rc start_6rd_tunnel os command injection
41RISK
open ↗
Referência
CVE-2026-50266
CVE-2026-50266LOW
In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another p
28RISK
open ↗
← previouspage 517 / 748next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.