Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,639cataloged exploits
40,918CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,402VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2024-6459
CVE-2024-6459CRITICAL
News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI
48RISK
open ↗
Referência
CVE-2009-3357
CVE-2009-3357—
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for
23RISK
open ↗
Referência
CVE-2009-4428
CVE-2009-4428—
SQL injection vulnerability in the JoomPortfolio (com_joomportfolio) component 1.0.0 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2010-2923
CVE-2010-2923—
SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2010-2923
CVE-2010-2923—
SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2010-4144
CVE-2010-4144—
SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2011-5112
CVE-2011-5112—
SQL injection vulnerability in Alameda (com_alameda) component before 1.0.1 for Joomla! allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2009-5091
CVE-2009-5091—
SQL injection vulnerability in page.php in Vlinks 1.0.3 and 1.1.6 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2009-2396
CVE-2009-2396—
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress p
23RISK
open ↗
Referência
CVE-2009-4140
CVE-2009-4140—
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer
60RISK
open ↗
Referência
CVE-2010-2911
CVE-2010-2911—
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2013-1828
CVE-2013-1828—
The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size
23RISK
open ↗
Referência★ 14
HTTP/2 Bomb
CVE-2026-49975HIGH
Apache HTTP Server: mod_http2 denial of service
53RISK
open ↗
Referência
CVE-2025-9605
CVE-2025-9605CRITICAL
Tenda AC21/AC23 GetParentControlInfo stack-based overflow
48RISK
open ↗
Referência
CVE-2025-9523
CVE-2025-9523CRITICAL
Tenda AC1206 GetParentControlInfo stack-based overflow
48RISK
open ↗
Referência
CVE-2010-2911
CVE-2010-2911—
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-4845
CVE-2010-4845—
Multiple SQL injection vulnerabilities in MH Products Projekt Shop allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2010-4846
CVE-2010-4846—
SQL injection vulnerability in view_item.php in MH Products Pay Pal Shop Digital allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2016-1583
CVE-2016-1583—
The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to ga
23RISK
open ↗
Referência✓ VexDay Proof
jPORTAL 2 - 'mailer.php' SQL Injection
CVE-2007-5974—webappsphp
SQL injection vulnerability in mailer.php in JPortal 2 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2026-87892
CVE-2026-87892MEDIUM
Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
33RISK
open ↗
Referência
CVE-2026-87891
CVE-2026-87891MEDIUM
Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
33RISK
open ↗
Referência✓ VexDay Proof
SHOP-INET 4 - 'grid' SQL Injection
CVE-2009-0292—webappsphp
SQL injection vulnerability in show_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2009-2585
CVE-2009-2585—
SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a m
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Carousel Flash Image Gallery - Remote File Inclusion
CVE-2007-6027—webappsphp
PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com_jjgallery) compo
23RISK
open ↗
Referência
CVE-2009-3713
CVE-2009-3713—
SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2009-3750
CVE-2009-3750—
SQL injection vulnerability in read.php in ToyLog 0.1 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component juser 1.0.14 - Remote File Inclusion
CVE-2007-6038—webappsphp
PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! all
28RISK
open ↗
Referência
CVE-2010-3026
CVE-2010-3026—
Cross-site request forgery (CSRF) vulnerability in application/modules/admin/controllers/users.php in Tomaz Muraus Open
23RISK
open ↗
Referência✓ VexDay Proof
myEvent 1.6 - 'eventdate' SQL Injection
CVE-2008-4650—webappsphp
SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
← previouspage 766 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.