Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
22,657 exploits
Referência✓ VexDay Proof
Joomla! Component ds-syndicate - 'feed_id' SQL Injection
CVE-2008-4623—webappsphp
SQL injection vulnerability in the DS-Syndicate (com_ds-syndicate) component 1.1.1 for Joomla allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
newsReporter 1.1 - 'index.php' Remote File Inclusion
CVE-2006-3988—webappsphp
PHP remote file inclusion vulnerability in index.php in Knusperleicht newsReporter 1.1 and earlier allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module makale 0.26 - SQL Injection
CVE-2008-4653—webappsphp
SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote
23RISK
open ↗
Referência
CVE-2017-17575
CVE-2017-17575—
FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
23RISK
open ↗
Referência
CVE-2026-12823
CVE-2026-12823MEDIUM
Browserbase Skills Autobrowse Trace Artifact default permission
33RISK
open ↗
Referência
CVE-2017-20261
CVE-2017-20261HIGH
Joomla! Component Bargain Product VM3 1.0 SQL Injection
41RISK
open ↗
Referência
CVE-2017-20260
CVE-2017-20260HIGH
Joomla! Component Price Alert 3.0.2 SQL Injection
41RISK
open ↗
Referência
CVE-2017-20259
CVE-2017-20259HIGH
Joomla OSDownloads 1.7.4 SQL Injection via item view
41RISK
open ↗
Referência
CVE-2017-20258
CVE-2017-20258HIGH
Joomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection
41RISK
open ↗
Referência
CVE-2026-8981
CVE-2026-8981LOW
Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML
28RISK
open ↗
Referência
CVE-2016-2386
CVE-2016-2386CRITICALunder attack
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi
100RISK
open ↗
Referência
CVE-2016-2386
CVE-2016-2386CRITICALunder attack
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi
100RISK
open ↗
Referência
CVE-2026-11585
CVE-2026-11585MEDIUM
CodeAstro Student Attendance Management System createClassArms.php sql injection
33RISK
open ↗
Referência
CVE-2016-2386
CVE-2016-2386CRITICALunder attack
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbi
100RISK
open ↗
Referência✓ VexDay Proof
Libera CMS 1.12 - 'cookie' SQL Injection
CVE-2008-4700—webappsphp
SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remot
23RISK
open ↗
Referência✓ VexDay Proof
Top Auction 1.0 - 'viewcat.php' SQL Injection
CVE-2005-3952—webappsphp
SQL injection vulnerability in PHP Labs Top Auction allows remote attackers to execute arbitrary SQL commands via the (1
23RISK
open ↗
Referência
CVE-2026-8777
CVE-2026-8777MEDIUM
Edimax BR-6428NS POST Request formStaDrvSetup command injection
33RISK
open ↗
Referência
CVE-2026-8776
CVE-2026-8776HIGH
Edimax BR-6428NS POST Request formPPTPSetup buffer overflow
41RISK
open ↗
Referência
CVE-2026-7315
CVE-2026-7315MEDIUM
eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal
33RISK
open ↗
Referência
CVE-2026-16979
CVE-2026-16979MEDIUM
SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration
33RISK
open ↗
Referência✓ VexDay Proof
BosNews 4.0 - 'article' SQL Injection
CVE-2008-4703—webappsphp
SQL injection vulnerability in news.php in BosDev BosNews 4.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
My PHP Dating - 'id' SQL Injection
CVE-2008-4705—webappsphp
SQL injection vulnerability in success_story.php in php Online Dating Software MyPHPDating allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2026-18395
CVE-2026-18395MEDIUM
Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
33RISK
open ↗
Referência
CVE-2026-16065
CVE-2026-16065MEDIUM
Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
33RISK
open ↗
Referência
CVE-2010-3404
CVE-2010-3404—
Multiple SQL injection vulnerabilities in eshtery CMS (aka eshtery.com) allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
1st News - SQL Injection
CVE-2008-4890—webappsphp
SQL injection vulnerability in products.php in 1st News 4 Professional (PR 1) allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2016-3081
CVE-2016-3081—
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
60RISK
open ↗
Referência
CVE-2026-14829
CVE-2026-14829HIGH
Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret
41RISK
open ↗
Referência
CVE-2026-75130
CVE-2026-75130MEDIUM
Context7 2.1.2 Prompt Injection via Custom AI Instructions
33RISK
open ↗
Referência
CVE-2026-10875
CVE-2026-10875MEDIUM
projectworlds Online Art Gallery Shop Project adminHome.ph sql injection
33RISK
open ↗
← previouspage 656 / 756next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.