Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,639cataloged exploits

40,918CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,402VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,560 exploits

Referência✓ VexDay Proof

minimal ablog 0.4 - SQL Injection / Arbitrary File Upload / Authentication Bypass

CVE-2008-6611—webappsphp

SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2010-1704

CVE-2010-1704—

Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2010-4750

CVE-2010-4750—

Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allow

23RISK

open ↗

Referência

CVE-2010-4750

CVE-2010-4750—

Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allow

23RISK

open ↗

Referência

CVE-2026-78145

CVE-2026-78145MEDIUM

CTFd __init__.py _is_safe_url redirect

33RISK

open ↗

Referência

CVE-2016-1000125

CVE-2016-1000125—

Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla

23RISK

open ↗

Referência

CVE-2008-0879

CVE-2008-0879—

SQL injection vulnerability in modules.php in the Web_Links module for PHP-Nuke allows remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2022-44283

CVE-2022-44283CRITICAL

AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.

48RISK

open ↗

Referência

CVE-2026-71505

CVE-2026-71505HIGH

Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

41RISK

open ↗

Referência

CVE-2024-22902

CVE-2024-22902CRITICAL

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

48RISK

open ↗

Referência✓ VexDay Proof

Chipmunk Blog - (Authentication Bypass) Add Admin

CVE-2009-0403—webappsphp

SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

PHP 5.2.4 ionCube - 'ioncube_read_file' Safe Mode / disable_functions Bypass

CVE-2007-5447—localwindows

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_funct

23RISK

open ↗

Referência✓ VexDay Proof

Eggdrop/Windrop 1.6.19 - ctcpbuf Remote Crash

CVE-2009-1789—dosmultiple

mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of

23RISK

open ↗

Referência

CVE-2009-2366

CVE-2009-2366—

SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

psipuss 1.0 - Multiple SQL Injections

CVE-2008-3598—webappsphp

Multiple SQL injection vulnerabilities in psipuss 1.0 allow remote attackers to execute arbitrary SQL commands via (1) t

23RISK

open ↗

Referência

CVE-2008-3755

CVE-2008-3755—

SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

e107 Plugin lyrics_menu - 'l_id' SQL Injection

CVE-2008-4906—webappsphp

SQL injection vulnerability in lyrics_song.php in the Lyrics (lyrics_menu) plugin 0.42 for e107 allows remote attackers

23RISK

open ↗

Referência

CVE-2010-2697

CVE-2010-2697—

Cross-site scripting (XSS) vulnerability in Sijio Community Software allows remote authenticated users to inject arbitra

23RISK

open ↗

Referência

CVE-2010-4006

CVE-2010-4006—

Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x be

23RISK

open ↗

Referência

CVE-2009-3599

CVE-2009-3599—

Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitr

23RISK

open ↗

Referência✓ VexDay Proof

Butterfly ORGanizer 2.0.1 - 'id' SQL Injection

CVE-2008-6311—webappsphp

SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

CVE-2010-4853

CVE-2010-4853—

SQL injection vulnerability in the ccInvoices (com_ccinvoices) component for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2012-0983

CVE-2012-0983—

SQL injection vulnerability in Scriptsez.net Ez Album allows remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2011-5031

CVE-2011-5031—

Multiple SQL injection vulnerabilities in servlet/capexweb.parentvalidatepassword in cApexWEB 1.1 allow remote attackers

23RISK

open ↗

Referência

CVE-2026-78054

CVE-2026-78054MEDIUM

SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting

33RISK

open ↗

Referência

CVE-2018-6593

CVE-2018-6593—

An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows

23RISK

open ↗

Referência

CVE-2019-18862

CVE-2019-18862—

maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.

23RISK

open ↗

Referência✓ VexDay Proof

2DayBiz Custom T-shirt Design - SQL Injection / Cross-Site Scripting

CVE-2009-1819—webappsphp

SQL injection vulnerability in product.php in 2daybiz Custom T-shirt Design Script allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2012-10033

CVE-2012-10033CRITICAL

Narcissus backend.php Image Configuration Command Injection

63RISK

open ↗

Referência

CVE-2012-10033

CVE-2012-10033CRITICAL

Narcissus backend.php Image Configuration Command Injection

63RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.