Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,154cataloged exploits

40,891CVEs with public exploitation

24,696lab-tested

All Referência 26,559Exploit-DB 24,489GitHub PoC 18,377VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,559 exploits

Referência

CVE-2012-3791

CVE-2012-3791—

Multiple SQL injection vulnerabilities in Simple Web Content Management System 1.1 allow remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2013-1959

CVE-2013-1959—

kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_m

23RISK

open ↗

Referência

CVE-2015-5148

CVE-2015-5148—

SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search

23RISK

open ↗

Referência✓ VexDay Proof

WSN Guest 1.21 - 'id' SQL Injection

CVE-2007-1517—webappsphp

SQL injection vulnerability in comments.php in WSN Guest 1.02 and 1.21 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

TaskDriver 1.2 - Authentication Bypass / SQL Injection

CVE-2007-2622—webappsphp

Multiple SQL injection vulnerabilities in TaskDriver 1.2 and earlier allow remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

LiveCMS 3.4 - 'categoria.php?cid' SQL Injection

CVE-2007-3293—webappsphp

SQL injection vulnerability in categoria.php in LiveCMS 3.4 and earlier allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Joomlaradio 5.0 - Remote File Inclusion

CVE-2007-4923—webappsphp

PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 (com_joomlaradiov5) component f

35RISK

open ↗

Referência

CVE-2012-4925

CVE-2012-4925—

Multiple SQL injection vulnerabilities in approve.php in Img Pals Photo Host 1.0 allow remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2013-5091

CVE-2013-5091—

SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated u

23RISK

open ↗

Referência✓ VexDay Proof

DataLife Engine 4.1 - SQL Injection

CVE-2006-3221—webappsphp

SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

CPCommerce 1.2.8 - 'id_document' Blind SQL Injection

CVE-2009-1345—webappsphp

SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência✓ VexDay Proof

Md-Pro 1.0.8x - Topics topicid SQL Injection

CVE-2007-3938—webappsphp

SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.8x and earlier before 20070720 allows remote attac

23RISK

open ↗

Referência

CVE-2024-3765

CVE-2024-3765CRITICAL

Xiongmai AHB7804R-MH-V2 Sofia Service access control

48RISK

open ↗

Referência✓ VexDay Proof

MailMachine Pro 2.2.4 - SQL Injection

CVE-2007-6551—webappsphp

SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote atta

23RISK

open ↗

Referência

CVE-2008-1349

CVE-2008-1349—

SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows

23RISK

open ↗

Referência

CVE-2008-1349

CVE-2008-1349—

SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows

23RISK

open ↗

Referência✓ VexDay Proof

MyioSoft EasyBookMarker 4.0 - Authentication Bypass

CVE-2008-5652—webappsphp

SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers

23RISK

open ↗

Referência

CVE-2010-4861

CVE-2010-4861—

SQL injection vulnerability in asearch.php in webSPELL 4.2.1 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2012-4178

CVE-2012-4178—

SQL injection vulnerability in spywall/includes/deptUploads_data.php in Symantec Web Gateway 5.0.3.18 allows remote atta

23RISK

open ↗

Referência

CVE-2026-14717

CVE-2026-14717MEDIUM

itsourcecode Hospital Management System patientlogin.php sql injection

33RISK

open ↗

Referência

CVE-2026-14700

CVE-2026-14700MEDIUM

code-projects Internship Management System Employer Login Endpoint login.php sql injection

33RISK

open ↗

Referência

CVE-2011-5203

CVE-2011-5203—

SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2017-2934

CVE-2017-2934—

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Te

28RISK

open ↗

Referência

CVE-2026-14655

CVE-2026-14655MEDIUM

code-projects Assessment Management view-users.php cross site scripting

33RISK

open ↗

Referência

CVE-2026-14640

CVE-2026-14640MEDIUM

CodeAstro Apartment Visitor Management System Login index.php sql injection

33RISK

open ↗

Referência

CVE-2026-14639

CVE-2026-14639MEDIUM

CodeAstro Ecommerce Website my_account.php sql injection

33RISK

open ↗

Referência

CVE-2026-14635

CVE-2026-14635MEDIUM

kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal

33RISK

open ↗

Referência

CVE-2015-8660

CVE-2015-8660—

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op

43RISK

open ↗

Referência

CVE-2012-10025

CVE-2012-10025CRITICAL

WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

63RISK

open ↗

Referência

CVE-2012-10025

CVE-2012-10025CRITICAL

WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

63RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.