Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2026-101142

CVE-2026-101142MEDIUM

Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal

33RISK

open ↗

Referência

CVE-2010-1047

CVE-2010-1047—

SQL injection vulnerability in index.php in MASA2EL Music City 1.0 and 1.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

iWare Pro 5.0.4 - 'chat_panel.php' Remote Code Execution

CVE-2006-5837—webappsphp

Static code injection vulnerability in chat_panel.php in the SimpleChat 1.0.0 module for iWare Professional CMS allows r

23RISK

open ↗

Referência

CVE-2010-1047

CVE-2010-1047—

SQL injection vulnerability in index.php in MASA2EL Music City 1.0 and 1.1 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2012-2437

CVE-2012-2437—

cookie_gen.php in ar web content manager (AWCM) 2.2 does not require authentication, which allows remote attackers to ge

23RISK

open ↗

Referência✓ VexDay Proof

TorrentFlux 2.2 - 'downloaddetails.php' Local File Disclosure

CVE-2006-6598—webappsphp

Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux before 2.2 and (2) torrentflux-b4rt before 2.1-b4rt-

23RISK

open ↗

Referência

CVE-2013-0803

CVE-2013-0803—

A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arb

60RISK

open ↗

Referência✓ VexDay Proof

NewsCMSLite - 'newsCMS.mdb' Remote Password Disclosure

CVE-2007-0091—webappsasp

newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

Supasite 1.23b - Multiple Remote File Inclusions

CVE-2007-2185—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Supasite 1.23b allow remote attackers to execute arbitrary PHP cod

23RISK

open ↗

Referência✓ VexDay Proof

PHP Photo Gallery 1.0 - 'photo_id' SQL Injection

CVE-2008-1711—webappsphp

Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database, which a

23RISK

open ↗

Referência

CVE-2008-2701

CVE-2008-2701—

SQL injection vulnerability in the GameQ (com_gameq) component 4.0 and earlier for Joomla! allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

AyeView 2.20 - Invalid Bitmap Header Parsing Crash

CVE-2008-5937—doswindows

AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a

23RISK

open ↗

Referência

CVE-2015-6911

CVE-2015-6911—

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2015-4137

CVE-2015-4137—

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2018-1204

CVE-2018-1204—

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, an

23RISK

open ↗

Referência

CVE-2012-1027

CVE-2012-1027—

Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possib

23RISK

open ↗

Referência

CVE-2026-101105

CVE-2026-101105MEDIUM

code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection

33RISK

open ↗

Referência

CVE-2026-81742

CVE-2026-81742HIGH

BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

41RISK

open ↗

Referência

CVE-2019-3999

CVE-2019-3999—

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, u

38RISK

open ↗

Referência✓ VexDay Proof

Cahier de texte 2.2 - Bypass General Access Protection

CVE-2006-6849—webappsphp

administration/index.php in Cahier de texte (CDT) 2.2 does not properly exit when authentication fails, which allows rem

23RISK

open ↗

Referência

CVE-2015-1400

CVE-2015-1400—

SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - GDI+ '.ICO' File Remote Denial of Service

CVE-2007-2237—doswindows

Microsoft Windows Graphics Device Interface (GDI+, GdiPlus.dll) allows context-dependent attackers to cause a denial of

28RISK

open ↗

Referência

CVE-2015-4137

CVE-2015-4137—

SQL injection vulnerability in related.php in Milw0rm Clone Script 1.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Flat PHP Board 1.2 - Multiple Vulnerabilities

CVE-2007-6396—webappsphp

Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inj

23RISK

open ↗

Referência

CVE-2015-6827

CVE-2015-6827—

Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentica

23RISK

open ↗

Referência✓ VexDay Proof

X7 Chat 2.0.5 - 'day' SQL Injection

CVE-2008-0278—webappsphp

SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)

CVE-2008-2938—remotemultiple

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16,

60RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component JoomlaDate 1.2 - 'user' SQL Injection

CVE-2008-6068—webappsphp

SQL injection vulnerability in the JoomlaDate (com_joomladate) component 1.2 for Joomla! allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2014-9096

CVE-2014-9096—

Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute a

23RISK

open ↗

Referência

CVE-2015-1476

CVE-2015-1476—

Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL comman

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.