Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência✓ VexDay Proof
FlexBB 0.5.5 - '/inc/start.php?_COOKIE' SQL Bypass
CVE-2006-1978—webappsphp
SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2015-4119
CVE-2015-4119—
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2015-4119
CVE-2015-4119—
Multiple cross-site request forgery (CSRF) vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2016-1885
CVE-2016-1885—
Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1
23RISK
open ↗
Referência✓ VexDay Proof
iG Calendar 1.0 - 'user.php?id' SQL Injection
CVE-2007-0130—webappsphp
SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
Okul Web Otomasyon Sistemi 4.0.1 - SQL Injection
CVE-2007-0305—webappsasp
SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
wolioCMS - Authentication Bypass / SQL Injection
CVE-2007-4156—webappsphp
Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via (1) the
23RISK
open ↗
Referência✓ VexDay Proof
Friendly Technologies - 'fwRemoteCfg.dll' ActiveX Command Execution
CVE-2008-4049—remotewindows
A certain ActiveX control in fwRemoteCfg.dll 3.3.3.1 in Friendly Technologies FriendlyPPPoE Client 3.0.0.57 allows remot
23RISK
open ↗
Referência
CVE-2026-105777
CVE-2026-105777MEDIUM
Insertion of Sensitive Information Into Sent Data in GitLab
33RISK
open ↗
Referência
CVE-2017-2935
CVE-2017-2935—
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the F
28RISK
open ↗
Referência
CVE-2021-43326
CVE-2021-43326—
Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory.
23RISK
open ↗
Referência
CVE-2017-1000409
CVE-2017-1000409—
A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environ
23RISK
open ↗
Referência✓ VexDay Proof
Frogss CMS 0.7 - SQL Injection
CVE-2007-2299—webappsphp
Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
team 1.x - File Disclosure / Cross-Site Scripting
CVE-2009-0761—webappsasp
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.0 Member_Space Module - SQL Injection
CVE-2007-4956—webappsphp
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗
Referência✓ VexDay Proof
MonGoose 2.4 (Windows) - WebServer Directory Traversal
CVE-2009-1354—remotewindows
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in
23RISK
open ↗
Referência✓ VexDay Proof
eXV2 Module bamaGalerie 3.03 - SQL Injection
CVE-2008-1349—webappsphp
SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows
23RISK
open ↗
Referência✓ VexDay Proof
phpBP RC3 (2.204) FIX4 - SQL Injection
CVE-2008-1408—webappsphp
SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attack
23RISK
open ↗
Referência
CVE-2010-2618
CVE-2010-2618—
PHP remote file inclusion vulnerability in inc/smarty/libs/init.php in AdaptCMS 2.0.0 Beta, when register_globals is ena
23RISK
open ↗
Referência✓ VexDay Proof
Autodealers CMS AutOnline - 'pageid' SQL Injection
CVE-2008-4073—webappsphp
SQL injection vulnerability in index.php in Zanfi Autodealers CMS AutOnline allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2011-4801
CVE-2011-4801—
SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authenticati
23RISK
open ↗
Referência
CVE-2012-1911
CVE-2012-1911—
Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2014-10015
CVE-2014-10015—
SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2017-3076
CVE-2017-3076—
Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the MPEG-4 AVC
28RISK
open ↗
Referência
CVE-2017-3141
CVE-2017-3141HIGH
Windows service and uninstall paths are not quoted when BIND is installed
41RISK
open ↗
Referência
CVE-2026-102491
CVE-2026-102491MEDIUM
mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection
33RISK
open ↗
Referência
CVE-2020-25540
CVE-2020-25540—
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on
60RISK
open ↗
Referência
CVE-2006-3362
CVE-2006-3362—
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) G
23RISK
open ↗
Referência
CVE-2026-96762
CVE-2026-96762MEDIUM
kvcache-ai mooncake RPC Path UnmountSegment authorization
33RISK
open ↗
Referência✓ VexDay Proof
AJ Forum 1.0 - 'topic_title.php' SQL Injection
CVE-2007-1295—webappsphp
SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
← previouspage 784 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.