Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,101cataloged exploits
35,950CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,406VulnCheck XDB 8,755Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,640 exploits
Referência
CVE-2026-19974
treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication
33RISK
open ↗Referência
CVE-2026-19973
itsourcecode Hospital Management System viewpaymentreport.php sql injection
33RISK
open ↗Referência
CVE-2009-2641
PHP remote file inclusion vulnerability in app_and_readme/navigator/index.php in School Data Navigator allows remote att
23RISK
open ↗Referência
CVE-2010-4099
ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary c
23RISK
open ↗Referência
CVE-2026-19972
itsourcecode Hospital Management System viewpatient.php sql injection
33RISK
open ↗Referência
CVE-2018-12326
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution
23RISK
open ↗Referência✓ VexDay Proof
MycroCMS 0.5 - Blind SQL Injection
SQL injection vulnerability in index.php in MycroCMS 0.5, when magic_quotes_gpc is disabled, allows remote attackers to
23RISK
open ↗Referência
CVE-2020-35416
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admi
23RISK
open ↗Referência
CVE-2020-35416
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admi
23RISK
open ↗Referência
CVE-2012-5293
Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2020-8776
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a
23RISK
open ↗Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to exec
23RISK
open ↗Referência✓ VexDay Proof
Ascended Guestbook 1.0.0 - 'embedded.php' File Inclusion
PHP remote file inclusion vulnerability in embedded.php in Ascended Guestbook 1.0.0 and earlier allows remote attackers
23RISK
open ↗Referência✓ VexDay Proof
FishCart 3.2 RC2 - 'fc_example.php' Remote File Inclusion
PHP remote file inclusion vulnerability in fc_functions/fc_example.php in FishCart 3.2 RC2 and earlier allows remote att
23RISK
open ↗Referência✓ VexDay Proof
NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection
SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows
23RISK
open ↗Referência✓ VexDay Proof
Simple HTTPd 1.38 - Multiple Vulnerabilities
Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI progra
23RISK
open ↗Referência✓ VexDay Proof
Mapbender 2.4.4 - 'gaz' SQL Injection
Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Referência
CVE-2012-6047
Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the aut
23RISK
open ↗Referência
CVE-2017-15977
Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.
23RISK
open ↗Referência✓ VexDay Proof
FreeCMS.us 0.2 - 'index.php' SQL Injection
SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Referência
CVE-2022-22947
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗Referência
CVE-2011-4066
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗Referência✓ VexDay Proof
mystats - 'hits.php' Multiple Vulnerabilities
hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H
23RISK
open ↗Referência✓ VexDay Proof
Yerba SACphp 6.3 - Multiple Vulnerabilities
Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galle
23RISK
open ↗Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3
23RISK
open ↗Referência
CVE-2017-17873
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
23RISK
open ↗Referência
CVE-2017-17872
The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.
23RISK
open ↗Referência
CVE-2017-17871
The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.