Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência✓ VexDay Proof
Riddles Complete Website 1.2.1 - 'riddleid' SQL Injection
SQL injection vulnerability in riddle.php in Riddles Website 1.2.1 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
PG Job Site - Blind SQL Injection
SQL injection vulnerability in homepage.php in PG Job Site Pro allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência✓ VexDay Proof
phpBB 3 - Mod Tag Board 4 Blind SQL Injection
SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
WEBBDOMAIN Post Card 1.02 - Authentication Bypass
SQL injection vulnerability in getin.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02 and earlier allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
WEBBDOMAIN Polls 1.01 - Authentication Bypass
SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute
23RISK
open ↗Referência
CVE-2021-21972
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗Referência
CVE-2009-4695
SQL injection vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component com_bayesiannaivefilter 1.1 - Remote File Inclusion
PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaiv
23RISK
open ↗Referência
CVE-2010-4955
SQL injection vulnerability in board/board.php in APBoard Developers APBoard 2.1.0 and earlier allows remote attackers t
23RISK
open ↗Referência
CVE-2010-1094
SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL
23RISK
open ↗Referência
CVE-2010-1073
SQL injection vulnerability in the jEmbed-Embed Anything (com_jembed) component for Joomla! allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
Mambo Component cropimage 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.cropcanvas.php in the CropImage component (com_cropimage) 1.0 for Mambo
23RISK
open ↗Referência✓ VexDay Proof
AvailScript Photo Album - 'pics.php' Multiple Vulnerabilities
SQL injection vulnerability in pics.php in Availscript Photo Album allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗Referência✓ VexDay Proof
AvailScript Article Script - 'articles.php' Multiple Vulnerabilities
SQL injection vulnerability in articles.php in AvailScript Article Script allows remote attackers to execute arbitrary S
23RISK
open ↗Referência
CVE-2026-7862
Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation
41RISK
open ↗Referência
CVE-2026-44711
pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
41RISK
open ↗Referência
CVE-2010-3148
Untrusted search path vulnerability in Microsoft Visio 2003 SP3 allows local users to gain privileges via a Trojan horse
28RISK
open ↗Referência
CVE-2016-1863
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local user
23RISK
open ↗Referência
CVE-2010-4963
SQL injection vulnerability in folder/list in Hulihan BXR 0.6.8 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência
CVE-2026-38945
Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary cod
41RISK
open ↗Referência
CVE-2010-3149
Untrusted search path vulnerability in Adobe Device Central CS5 3.0.0(376), 3.0.1.0 (3027), and probably other versions
28RISK
open ↗Referência
CVE-2017-15983
MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing
23RISK
open ↗Referência
CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.