Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits

35,961CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecent popular risk

22,657 exploits

Referência

CVE-2010-2513

CVE-2010-2513—

SQL injection vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.5 for Joomla! allows r

23RISK

open ↗

Referência

CVE-2006-3823

CVE-2006-3823—

SQL injection vulnerability in index.php in GeodesicSolutions (1) GeoAuctions Premier 2.0.3 and (2) GeoClassifieds Basic

23RISK

open ↗

Referência

CVE-2026-19894

CVE-2026-19894MEDIUM

itsourcecode Hospital Management System viewmedicine.php sql injection

33RISK

open ↗

Referência

CVE-2026-71959

CVE-2026-71959MEDIUM

Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

33RISK

open ↗

Referência

CVE-2026-18807

CVE-2026-18807MEDIUM

ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers

33RISK

open ↗

Referência

CVE-2015-8427

CVE-2015-8427—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and

35RISK

open ↗

Referência

CVE-2026-18786

CVE-2026-18786HIGH

CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

41RISK

open ↗

Referência

CVE-2021-32172

CVE-2021-32172—

Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the

50RISK

open ↗

Referência

CVE-2011-10032

CVE-2011-10032CRITICAL

Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

63RISK

open ↗

Referência

CVE-2011-10032

CVE-2011-10032CRITICAL

Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

63RISK

open ↗

Referência

CVE-2011-10032

CVE-2011-10032CRITICAL

Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

63RISK

open ↗

Referência

CVE-2009-3162

CVE-2009-3162—

Cross-site scripting (XSS) vulnerability in Multi Website 1.5 allows remote attackers to inject arbitrary web script or

23RISK

open ↗

Referência

CVE-2010-1112

CVE-2010-1112—

Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web scrip

23RISK

open ↗

Referência

CVE-2009-20005

CVE-2009-20005CRITICAL

InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2009-20005

CVE-2009-20005CRITICAL

InterSystems Caché UtilConfigHome.csp Stack Buffer Overflow

63RISK

open ↗

Referência

CVE-2009-4858

CVE-2009-4858—

Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject

23RISK

open ↗

Referência

CVE-2009-4868

CVE-2009-4868—

Cross-site scripting (XSS) vulnerability in Hitron Soft Answer Me 1.0 allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Referência

CVE-2009-3901

CVE-2009-3901—

Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web scri

23RISK

open ↗

Referência

CVE-2009-3833

CVE-2009-3833—

Cross-site scripting (XSS) vulnerability in index.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web

23RISK

open ↗

Referência

CVE-2010-1350

CVE-2010-1350—

SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

ILIAS 3.7.4 - 'ref_id' Blind SQL Injection

CVE-2008-5816—webappsphp

SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2015-8562

CVE-2015-8562—

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

open ↗

Referência

CVE-2015-8562

CVE-2015-8562—

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

open ↗

Referência

CVE-2015-1875

CVE-2015-1875—

SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attacker

23RISK

open ↗

Referência

CVE-2015-1875

CVE-2015-1875—

SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attacker

23RISK

open ↗

Referência

CVE-2015-8562

CVE-2015-8562—

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

open ↗

Referência

CVE-2014-2091

CVE-2014-2091—

Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote auth

23RISK

open ↗

Referência

CVE-2020-20141

CVE-2020-20141—

Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Tab

23RISK

open ↗

Referência✓ VexDay Proof

Simplog 0.9.3.1 - 'comments.php' SQL Injection

CVE-2006-5398—webappsphp

SQL injection vulnerability in comments.php in Simplog 0.9.3.1 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2020-20142

CVE-2020-20142—

Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table &

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.