Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2023-54357
CVE-2023-54357HIGH
Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
41RISK
open ↗
Referência
CVE-2019-25762
CVE-2019-25762HIGH
Joomla! Component JoomProject 1.1.3.2 Information Disclosure
41RISK
open ↗
Referência
CVE-2026-80428
CVE-2026-80428CRITICAL
ILIAS PHP Object Injection via Shibboleth Logout
48RISK
open ↗
Referência
CVE-2026-57951
CVE-2026-57951HIGH
Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table
41RISK
open ↗
Referência
CVE-2026-19223
CVE-2026-19223HIGH
Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
41RISK
open ↗
Referência
CVE-2026-82556
CVE-2026-82556MEDIUM
Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
33RISK
open ↗
Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
CVE-2007-6399—webappsphp
index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current use
23RISK
open ↗
Referência
CVE-2017-8684
CVE-2017-8684—
Windows GDI+ on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R
23RISK
open ↗
Referência
CVE-2010-3203
CVE-2010-3203—
Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read
38RISK
open ↗
Referência
CVE-2010-3204
CVE-2010-3204—
Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗
Referência
CVE-2017-16928
CVE-2017-16928—
The arq_updater binary in Arq 5.10 and earlier for Mac allows local users to write to arbitrary files and consequently g
23RISK
open ↗
Referência
CVE-2017-8708
CVE-2017-8708—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RISK
open ↗
Referência
CVE-2025-32432
CVE-2025-32432CRITICALunder attack
Craft CMS Allows Remote Code Execution
100RISK
open ↗
Referência
CVE-2026-109935
CVE-2026-109935MEDIUM
Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API
33RISK
open ↗
Referência
CVE-2009-4596
CVE-2009-4596—
Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2017-17570
CVE-2017-17570—
FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_o
23RISK
open ↗
Referência
CVE-2010-4970
CVE-2010-4970—
SQL injection vulnerability in handlers/getpage.php in Wiki Web Help 0.28 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2026-58054
CVE-2026-58054—
3RISK
open ↗
Referência
CVE-2010-3306
CVE-2010-3306—
Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers t
23RISK
open ↗
Referência
CVE-2026-49948
CVE-2026-49948HIGH
Mem0 0.2.8 Missing Authorization via POST /configure Endpoint
21RISK
open ↗
Referência✓ VexDay Proof
PG Matchmaking Script - Multiple SQL Injections
CVE-2008-4665—webappsphp
SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id param
23RISK
open ↗
Referência
CVE-2017-17571
CVE-2017-17571—
FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
23RISK
open ↗
Referência
CVE-2026-9384
CVE-2026-9384CRITICAL
Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection
48RISK
open ↗
Referência
CVE-2026-9383
CVE-2026-9383MEDIUM
itsourcecode Electronic Judging System login.php sql injection
33RISK
open ↗
Referência
CVE-2026-9382
CVE-2026-9382HIGH
Edimax BR-6675nD POST Request formPPTPSetup buffer overflow
41RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6496—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to host
23RISK
open ↗
Referência
CVE-2009-3057
CVE-2009-3057—
Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2026-24065
CVE-2026-24065HIGH
Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOS
41RISK
open ↗
Referência
CVE-2026-25558
CVE-2026-25558MEDIUM
QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager
13RISK
open ↗
Referência
CVE-2009-4621
CVE-2009-4621—
SQL injection vulnerability in the JiangHu Inn plugin 1.1 and earlier for Discuz! allows remote attackers to execute arb
23RISK
open ↗
← previouspage 753 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.