Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,149cataloged exploits

40,888CVEs with public exploitation

24,696lab-tested

All Referência 26,559Exploit-DB 24,489GitHub PoC 18,372VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,559 exploits

Referência

CVE-2022-3915

CVE-2022-3915CRITICAL

Dokan < 3.7.6 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2026-103382

CVE-2026-103382MEDIUM

Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

33RISK

open ↗

Referência✓ VexDay Proof

Mambo Component MamboWiki 0.9.6 - Remote File Inclusion

CVE-2006-4282—webappsphp

PHP remote file inclusion vulnerability in MamboLogin.php in the MamboWiki component (com_mambowiki) 0.9.6 and earlier f

23RISK

open ↗

Referência

CVE-2010-4872

CVE-2010-4872—

SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

TorrentTrader Classic 1.09 - Multiple Vulnerabilities

CVE-2009-2156—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to in

23RISK

open ↗

Referência✓ VexDay Proof

InstaGuide Weather Script 1.0 - 'index.php' Local File Inclusion

CVE-2007-5674—webappsphp

Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is

23RISK

open ↗

Referência

CVE-2010-2853

CVE-2010-2853—

SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2010-2853

CVE-2010-2853—

SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component jooget 2.6.8 - SQL Injection

CVE-2008-0829—webappsphp

SQL injection vulnerability in jooget.php in the Joomlapixel Jooget! (com_jooget) 2.6.8 component for Joomla! and Mambo

23RISK

open ↗

Referência

CVE-2026-14752

CVE-2026-14752MEDIUM

mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting

33RISK

open ↗

Referência✓ VexDay Proof

EQdkp 1.3.2f - 'user_id' Authentication Bypass

CVE-2008-2222—webappsphp

SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via

23RISK

open ↗

Referência✓ VexDay Proof

Link Bid Script 1.5 - Multiple SQL Injections

CVE-2008-4175—webappsphp

Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2012-5342

CVE-2012-5342—

Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2016-1011

CVE-2016-1011—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows

28RISK

open ↗

Referência✓ VexDay Proof

FlashGet 1.9.0.1012 - 'FTP PWD Response' SEH Stack Overflow

CVE-2008-4321—remotewindows

Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long res

23RISK

open ↗

Referência

CVE-2016-1013

CVE-2016-1013—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows

28RISK

open ↗

Referência

CVE-2026-14751

CVE-2026-14751MEDIUM

mjperpinosa stumasy search_scratch_data.php search_scratch_data sql injection

33RISK

open ↗

Referência

CVE-2026-117515

CVE-2026-117515MEDIUM

oretnom23 php-travel-agency-system traceapplication.php sql injection

33RISK

open ↗

Referência✓ VexDay Proof

Carom3D 5.06 - Unicode Buffer Overrun/Denial of Service

CVE-2009-2173—doswindows

The LAN game feature in Carom3D 5.06 allows remote authenticated users to cause a denial of service (application hang) v

23RISK

open ↗

Referência

CVE-2014-125136

CVE-2014-125136HIGH

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

41RISK

open ↗

Referência✓ VexDay Proof

ScriptMagix FAQ Builder 2.0 - 'index.php' SQL Injection

CVE-2007-1618—webappsphp

SQL injection vulnerability in index.php in ScriptMagix FAQ Builder 2.0 and earlier allows remote attackers to execute a

23RISK

open ↗

Referência

CVE-2014-125136

CVE-2014-125136HIGH

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

41RISK

open ↗

Referência✓ VexDay Proof

pc4 Uploader 10.0 - Remote File Disclosure

CVE-2009-2180—webappsphp

Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attacker

23RISK

open ↗

Referência

CVE-2022-4445

CVE-2022-4445CRITICAL

FL3R FeelBox <= 8.1 - Unauthenticated SQLi

48RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module Glossarie 1.7 - 'sid' SQL Injection

CVE-2007-2738—webappsphp

SQL injection vulnerability in glossaire-p-f.php in the Glossaire 1.7 and earlier module for Xoops allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Simple Shop Galore 3.x - 'catid' SQL Injection

CVE-2008-2568—webappsphp

SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) component 3.4 and earlier for Joomla! allows remo

23RISK

open ↗

Referência

CVE-2011-1565

CVE-2011-1565—

Directory traversal vulnerability in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphica

50RISK

open ↗

Referência✓ VexDay Proof

Vastal I-Tech Agent Zone - 'ann_id' SQL Injection

CVE-2008-3951—webappsphp

SQL injection vulnerability in view_ann.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attac

23RISK

open ↗

Referência

CVE-2013-4953

CVE-2013-4953—

SQL injection vulnerability in play.php in Top Games Script 1.2 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2016-10176

CVE-2016-10176—

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the w

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.