Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência✓ VexDay Proof
Dream4 Koobi Pro 6.25 Poll - 'poll_id' SQL Injection
CVE-2008-2036—webappsphp
SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin BLOG Engine 2.1.4 - SQL Injection
CVE-2008-6438—webappsphp
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows re
23RISK
open ↗
Referência✓ VexDay Proof
CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload
CVE-2008-2650—webappsphp
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote a
43RISK
open ↗
Referência✓ VexDay Proof
smbftpd 0.96 - SMBDirList-function Remote Format String
CVE-2007-5184—remotelinux
Format string vulnerability in the SMBDirList function in dirlist.c in SmbFTPD 0.96 allows remote attackers to execute a
28RISK
open ↗
Referência✓ VexDay Proof
PHP wcms XT 0.0.7 - Multiple Remote File Inclusions
CVE-2007-5185—webappsphp
Multiple PHP remote file inclusion vulnerabilities in phpWCMS XT 0.0.7 BETA and earlier allow remote attackers to execut
35RISK
open ↗
Referência✓ VexDay Proof
Microsoft Office 2003 - '.wps' Local Stack Overflow (MS08-011)
CVE-2008-0108—localwindows
Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Wor
35RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component iJoomla! News Portal 1.0 - 'itemID' SQL Injection
CVE-2008-2676—webappsphp
SQL injection vulnerability in the iJoomla News Portal (com_news_portal) component 1.0 and earlier for Joomla! allows re
23RISK
open ↗
Referência✓ VexDay Proof
Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
CVE-2008-2677—webappsphp
Cross-site scripting (XSS) vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
Openfire Server 3.6.0a - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2008-6511—webappsjsp
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect users to arb
23RISK
open ↗
Referência✓ VexDay Proof
Andy's PHP KnowledgeBase 0.92.9 - Arbitrary File Upload
CVE-2008-6513—webappsphp
Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
OpenInvoice 0.9 - Arbitrary Change User Password
CVE-2008-6523—webappsphp
auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by se
23RISK
open ↗
Referência✓ VexDay Proof
BosClassifieds - 'cat_id' SQL Injection
CVE-2008-6526—webappsphp
SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
CVE-2008-6529—webappsphp
Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inj
23RISK
open ↗
Referência✓ VexDay Proof
living Local 1.1 - Cross-Site Scripting / Arbitrary File Upload
CVE-2008-6530—webappsphp
Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated adm
23RISK
open ↗
Referência
CVE-2012-6519
CVE-2012-6519—
SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2014-8322
CVE-2014-8322—
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attac
28RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16015
CVE-2026-16015MEDIUM
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
33RISK
open ↗
Referência
CVE-2026-16014
CVE-2026-16014MEDIUM
code-projects Hospital Bed Management System Login Form sql injection
33RISK
open ↗
Referência
Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass
CVE-2021-44655—webappsphp
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. A
23RISK
open ↗
Referência
CVE-2026-84896
CVE-2026-84896MEDIUM
King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
33RISK
open ↗
Referência
CVE-2026-84745
CVE-2026-84745LOW
The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
28RISK
open ↗
Referência
CVE-2013-0238
CVE-2013-0238—
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allo
23RISK
open ↗
Referência
CVE-2026-16013
CVE-2026-16013MEDIUM
liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds
33RISK
open ↗
Referência
CVE-2026-11961
CVE-2026-11961HIGH
User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID
41RISK
open ↗
Referência
CVE-2014-8356
CVE-2014-8356—
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended a
23RISK
open ↗
Referência
CVE-2008-6617
CVE-2008-6617—
Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
FluentCMS - 'view.php' SQL Injection
CVE-2008-6642—webappsphp
SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2009-4751
CVE-2009-4751—
SQL injection vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2013-1852
CVE-2013-1852—
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote at
23RISK
open ↗
← previouspage 692 / 881next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.