Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,139cataloged exploits
40,879CVEs with public exploitation
24,696lab-tested
AllReferência 26,555Exploit-DB 24,489GitHub PoC 18,366VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,559 exploits
Referência
CVE-2015-8562
CVE-2015-8562—
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi
60RISK
open ↗
Referência
CVE-2009-3833
CVE-2009-3833—
Cross-site scripting (XSS) vulnerability in index.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2009-3162
CVE-2009-3162—
Cross-site scripting (XSS) vulnerability in Multi Website 1.5 allows remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2009-4858
CVE-2009-4858—
Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
CVE-2007-4891—remotewindows
A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) St
35RISK
open ↗
Referência
CVE-2009-3901
CVE-2009-3901—
Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência✓ VexDay Proof
ILIAS 3.7.4 - 'ref_id' Blind SQL Injection
CVE-2008-5816—webappsphp
SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2010-1112
CVE-2010-1112—
Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2014-2091
CVE-2014-2091—
Cross-site scripting (XSS) vulnerability in mods/_standard/forums/admin/forum_add.php in ATutor 2.1.1 allows remote auth
23RISK
open ↗
Referência
CVE-2015-1875
CVE-2015-1875—
SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attacker
23RISK
open ↗
Referência
CVE-2015-1875
CVE-2015-1875—
SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attacker
23RISK
open ↗
Referência
CVE-2015-8562
CVE-2015-8562—
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi
60RISK
open ↗
Referência
CVE-2026-100883
CVE-2026-100883MEDIUM
Krayin laravel-crm acl.php access control
33RISK
open ↗
Referência
CVE-2026-10220
CVE-2026-10220MEDIUM
NousResearch hermes-agent skills_tool.py skill_view injection
33RISK
open ↗
Referência
CVE-2026-8113
CVE-2026-8113MEDIUM
8421bit MiniClaw executeSkillScript kernel.ts isPathInside path traversal
33RISK
open ↗
Referência
CVE-2026-8112
CVE-2026-8112MEDIUM
8421bit MiniClaw kernel.ts executeCognitivePulse os command injection
33RISK
open ↗
Referência
CVE-2012-5334
CVE-2012-5334—
SQL injection vulnerability in product_desc.php in Pre Printing Press allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2022-50691
CVE-2022-50691CRITICAL
MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh
48RISK
open ↗
Referência
CVE-2026-4252
CVE-2026-4252CRITICAL
Tenda AC8 IPv6 check_is_ipv6 ip address for authentication
48RISK
open ↗
Referência
CVE-2014-10019
CVE-2014-10019—
Multiple cross-site request forgery (CSRF) vulnerabilities in webconfig/wlan/country.html/country in the Teracom T2-B-Ga
23RISK
open ↗
Referência✓ VexDay Proof
FlexBB 0.5.5 - '/inc/start.php?_COOKIE' SQL Bypass
CVE-2006-1978—webappsphp
SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2015-4119
CVE-2015-4119—
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2015-4119
CVE-2015-4119—
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2016-1885
CVE-2016-1885—
Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1
23RISK
open ↗
Referência✓ VexDay Proof
iG Calendar 1.0 - 'user.php?id' SQL Injection
CVE-2007-0130—webappsphp
SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
Okul Web Otomasyon Sistemi 4.0.1 - SQL Injection
CVE-2007-0305—webappsasp
SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
wolioCMS - Authentication Bypass / SQL Injection
CVE-2007-4156—webappsphp
Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the
23RISK
open ↗
Referência✓ VexDay Proof
Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Command Execution
CVE-2008-4049—remotewindows
A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remot
23RISK
open ↗
Referência
CVE-2026-86839
CVE-2026-86839LOW
Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
28RISK
open ↗
Referência
CVE-2017-11165
CVE-2017-11165—
dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a d
50RISK
open ↗
← previouspage 757 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.