Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2009-4661

CVE-2009-4661—

Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial o

23RISK

open ↗

Referência

CVE-2018-7319

CVE-2018-7319—

SQL Injection exists in the OS Property Real Estate 3.12.7 component for Joomla! via the cooling_system1, heating_system

23RISK

open ↗

Referência

CVE-2019-11193

CVE-2019-11193—

The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESE

23RISK

open ↗

Referência

CVE-2026-15622

CVE-2026-15622MEDIUM

poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization

33RISK

open ↗

Referência

CVE-2009-5094

CVE-2009-5094—

SQL injection vulnerability in info.php in CMS Faethon 2.2.0 Ultimate allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2026-75784

CVE-2026-75784CRITICAL

TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

48RISK

open ↗

Referência✓ VexDay Proof

Claroline E-Learning 1.75 - 'ldap.inc.php' Remote File Inclusion

CVE-2006-2284—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP co

23RISK

open ↗

Referência

CVE-2012-6042

CVE-2012-6042—

GPSMapEdit 1.1.73.2 allows user-assisted remote attackers to cause a denial of service (crash) via a long string in a ls

23RISK

open ↗

Referência

CVE-2010-2618

CVE-2010-2618—

PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is ena

23RISK

open ↗

Referência

CVE-2010-4967

CVE-2010-4967—

SQL injection vulnerability in default.asp in ATCOM Netvolution 2.5.6 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2015-5531

CVE-2015-5531—

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp

60RISK

open ↗

Referência

CVE-2010-2618

CVE-2010-2618—

PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is ena

23RISK

open ↗

Referência✓ VexDay Proof

OpenBASE 0.6a - 'root_prefix' Remote File Inclusion

CVE-2007-2947—webappsphp

Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection

CVE-2008-6748—remotewindows

Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the

23RISK

open ↗

Referência

CVE-2026-16739

CVE-2026-16739MEDIUM

Epeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery

33RISK

open ↗

Referência

CVE-2011-4026

CVE-2011-4026—

SQL injection vulnerability in thanks.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2026-19710

CVE-2026-19710MEDIUM

SourceCodester Simple Student Information System view_department.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

AuraCMS 2.1 - Remote File Attachment / Local File Inclusion

CVE-2007-4886—webappsphp

Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2023-31903

CVE-2023-31903CRITICAL

GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by u

48RISK

open ↗

Referência✓ VexDay Proof

WebSihirbazi 5.1.1 - 'pageid' SQL Injection

CVE-2007-6556—webappsphp

Multiple SQL injection vulnerabilities in websihirbazi 5.1.1 allow remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2013-7043

CVE-2013-7043—

Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Scientific Atlanta DPR2320R2 routers with software 2

23RISK

open ↗

Referência

CVE-2014-4741

CVE-2014-4741—

SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2016-9091

CVE-2016-9091—

Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 and Content Analysis System (CAS) 1.3 before 1.3.7.4 are susc

23RISK

open ↗

Referência

CVE-2020-11978

CVE-2020-11978HIGHunder attack

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco

100RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mediaslide - 'albumnum' Blind SQL Injection

CVE-2008-0802—webappsphp

SQL injection vulnerability in index.php in the MediaSlide (com_mediaslide) 0.5 component for Joomla! allows remote atta

23RISK

open ↗

Referência

CVE-2020-17382

CVE-2020-17382—

The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054).

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Acajoom 1.1.5 - SQL Injection

CVE-2008-1427—webappsphp

SQL injection vulnerability in the Joobi Acajoom (com_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

bilboblog 2.1 - Multiple Vulnerabilities

CVE-2008-3301—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in BilboBlog 0.2.1 allow remote authenticated administrators to inje

23RISK

open ↗

Referência✓ VexDay Proof

vicFTP 5.0 - 'LIST' Remote Denial of Service

CVE-2008-6829—doswindows

VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a LIST command that starts with a "/\/" (fo

50RISK

open ↗

Referência✓ VexDay Proof

CMSbright - 'id_rub_page' SQL Injection

CVE-2008-6991—webappsphp

SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.