Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,560 exploits

Referência✓ VexDay Proof

PHP-Nuke Module Inhalt - 'cid' SQL Injection

CVE-2008-0907—webappsphp

SQL injection vulnerability in the Inhalt module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2011-1974

CVE-2011-1974—

NDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2 and SP3 and Windows Serve

23RISK

open ↗

Referência✓ VexDay Proof

MultiCart 2.0 - 'productdetails.php' SQL Injection

CVE-2008-0911—webappsphp

SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute

23RISK

open ↗

Referência

CVE-2012-2587

CVE-2012-2587—

Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arb

23RISK

open ↗

Referência

CVE-2014-8357

CVE-2014-8357—

backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a

23RISK

open ↗

Referência

CVE-2026-10185

CVE-2026-10185MEDIUM

SourceCodester Hospitals Patient Records Management System Users.php save sql injection

33RISK

open ↗

Referência

CVE-2026-10169

CVE-2026-10169MEDIUM

OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery

33RISK

open ↗

Referência

CVE-2026-7393

CVE-2026-7393MEDIUM

SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload

33RISK

open ↗

Referência

CVE-2026-7680

CVE-2026-7680MEDIUM

jsbroks COCO Annotator Data Endpoint datasets.py path traversal

33RISK

open ↗

Referência

CVE-2026-7408

CVE-2026-7408MEDIUM

SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection

33RISK

open ↗

Referência

CVE-2026-6622

CVE-2026-6622MEDIUM

BichitroGan ISP Billing Software Customer edit cross site scripting

33RISK

open ↗

Referência

CVE-2026-6620

CVE-2026-6620MEDIUM

SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal

33RISK

open ↗

Referência

CVE-2026-6619

CVE-2026-6619MEDIUM

langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting

33RISK

open ↗

Referência✓ VexDay Proof

Bloo 1.00 - Multiple SQL Injections

CVE-2008-1313—webappsphp

Multiple SQL injection vulnerabilities in index.php in Bloo 1.00 and earlier allow remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2026-7612

CVE-2026-7612MEDIUM

itsourcecode Courier Management System edit_user.php sql injection

33RISK

open ↗

Referência

CVE-2026-7609

CVE-2026-7609MEDIUM

TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection

33RISK

open ↗

Referência

CVE-2026-7608

CVE-2026-7608MEDIUM

TRENDnet TEW-821DAP tools_diagnostic os command injection

33RISK

open ↗

Referência

CVE-2026-6618

CVE-2026-6618MEDIUM

langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery

33RISK

open ↗

Referência

CVE-2026-6616

CVE-2026-6616MEDIUM

TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery

33RISK

open ↗

Referência

CVE-2018-17128

CVE-2018-17128—

A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.

45RISK

open ↗

Referência

CVE-2026-7545

CVE-2026-7545MEDIUM

SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection

33RISK

open ↗

Referência

CVE-2026-7538

CVE-2026-7538CRITICAL

Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection

48RISK

open ↗

Referência

CVE-2026-7536

CVE-2026-7536MEDIUM

Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of service

33RISK

open ↗

Referência

CVE-2026-7535

CVE-2026-7535MEDIUM

Open5GS transfer-update denial of service

33RISK

open ↗

Referência

CVE-2016-8021

CVE-2016-8021—

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3

23RISK

open ↗

Referência

CVE-2026-78434

CVE-2026-78434MEDIUM

Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication

33RISK

open ↗

Referência

CVE-2014-9195

CVE-2014-9195—

Phoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function

85RISK

open ↗

Referência

CVE-2026-6623

CVE-2026-6623MEDIUM

BichitroGan ISP Billing Software Profile users-view cross site scripting

33RISK

open ↗

Referência

CVE-2013-6935

CVE-2013-6935—

Buffer overflow in VideoCharge Software Watermark Master 2.2.23 allows remote attackers to execute arbitrary code via a

50RISK

open ↗

Referência

CVE-2011-5267

CVE-2011-5267—

Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha, as

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.