Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2020-7247
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RISK
open ↗Referência
CVE-2007-5816
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to obtain sensitive author credentials by maki
23RISK
open ↗Referência✓ VexDay Proof
Netartmedia Blog System - SQL Injection
SQL injection vulnerability in image.php in NetArt Media Blog System 1.5 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Referência✓ VexDay Proof
SFS EZ Career - SQL Injection
SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2009-3969
Stack-based buffer overflow in Faslo Player 7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗Referência
CVE-2009-3970
SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote auth
23RISK
open ↗Referência
CVE-2010-2916
SQL injection vulnerability in news.php in AJ Square AJ HYIP MERIDIAN allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Referência
CVE-2016-1104
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗Referência
CVE-2020-36885
Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi
48RISK
open ↗Referência
CVE-2023-54329
Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)
48RISK
open ↗Referência✓ VexDay Proof
Groone's GLink ORGanizer - 'index.php?cat' SQL Injection
SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2021-33351
Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allo
48RISK
open ↗Referência✓ VexDay Proof
FLDS 1.2a - 'lpro.php' SQL Injection
SQL injection vulnerability in lpro.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
AskPert - Authentication Bypass
SQL injection vulnerability in index.php in W3matter AskPert allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência
CVE-2009-2306
The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control,
23RISK
open ↗Referência
CVE-2009-4196
Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T run
23RISK
open ↗Referência
CVE-2023-48901
A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute
48RISK
open ↗Referência
CVE-2010-1078
SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbit
23RISK
open ↗Referência
CVE-2010-2921
SQL injection vulnerability in the Golf Course Guide (com_golfcourseguide) component 0.9.6.0 beta and 1 beta for Joomla!
23RISK
open ↗Referência
CVE-2010-4782
Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allo
23RISK
open ↗Referência
CVE-2014-5453
Ubisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program installation directory
23RISK
open ↗Referência
CVE-2026-51772
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multi
33RISK
open ↗Referência
CVE-2026-97368
chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization
33RISK
open ↗Referência✓ VexDay Proof
LocazoList 2.01a beta5 - 'subcatID' SQL Injection
SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component live chat - SQL Injection / Open Proxy
Multiple SQL injection vulnerabilities in the Live Chat (com_livechat) component 1.0 for Joomla! allow remote attackers
23RISK
open ↗Referência
CVE-2009-2234
Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to ex
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module debaser 0.92 - 'genre.php' Blind SQL Injection
SQL injection vulnerability in genre.php in the debaser 0.92 and earlier module for Xoops allows remote attackers to exe
23RISK
open ↗Referência
CVE-2009-2308
Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier fo
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! al
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.