Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência✓ VexDay Proof
CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection
CVE-2008-2866—webappsphp
SQL injection vulnerability in csc_article_details.php in Caupo.net CaupoShop Classic 1.3 allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2026-12378
CVE-2026-12378HIGH
BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection
41RISK
open ↗
Referência
CVE-2026-58583
CVE-2026-58583HIGH
FluxInk Color Management Driver local privilege escalation
41RISK
open ↗
Referência
CVE-2026-58468
CVE-2026-58468MEDIUM
NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
33RISK
open ↗
Referência
CVE-2026-120276
CVE-2026-120276CRITICAL
WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection
48RISK
open ↗
Referência
CVE-2026-84902
CVE-2026-84902MEDIUM
King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import
33RISK
open ↗
Referência
CVE-2025-15668
CVE-2025-15668MEDIUM
GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow
33RISK
open ↗
Referência
CVE-2025-15667
CVE-2025-15667MEDIUM
GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free
33RISK
open ↗
Referência
CVE-2026-84738
CVE-2026-84738CRITICAL
AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE
48RISK
open ↗
Referência
CVE-2026-81810
CVE-2026-81810HIGH
All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure
41RISK
open ↗
Referência✓ VexDay Proof
Binn SBuilder - 'nid' Blind SQL Injection
CVE-2008-0253—webappsphp
SQL injection vulnerability in full_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-120242
CVE-2026-120242MEDIUM
Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting
33RISK
open ↗
Referência
CVE-2026-120241
CVE-2026-120241HIGH
Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow
41RISK
open ↗
Referência
CVE-2026-120240
CVE-2026-120240CRITICAL
WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
48RISK
open ↗
Referência
CVE-2026-14713
CVE-2026-14713MEDIUM
SourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injection
33RISK
open ↗
Referência✓ VexDay Proof
TutorialCMS 1.02 - 'Username' SQL Injection
CVE-2008-0254—webappsphp
SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is disa
23RISK
open ↗
Referência✓ VexDay Proof
Pluck CMS 4.5.1 (Windows) - 'blogpost' Local File Inclusion
CVE-2008-3194—webappsphp
Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote att
23RISK
open ↗
Referência✓ VexDay Proof
WebCMS Portal Edition - 'id' SQL Injection
CVE-2008-3213—webappsphp
SQL injection vulnerability in secciones/tablon/tablon.php in WebCMS Portal Edition allows remote attackers to execute a
23RISK
open ↗
Referência✓ VexDay Proof
Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (2)
CVE-2008-3250—webappsphp
SQL injection vulnerability in index.php in Arctic Issue Tracker 2.0.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
cyberBB 0.6 - Multiple SQL Injections
CVE-2008-3718—webappsphp
Multiple SQL injection vulnerabilities in cyberBB 0.6 allow remote authenticated users to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-5952
CVE-2026-5952MEDIUM
Incorrect Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-120196
CVE-2026-120196CRITICAL
WAVLINK WN579X3-D wapi.cgi port_forward os command injection
48RISK
open ↗
Referência
CVE-2026-10712
CVE-2026-10712HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗
Referência
CVE-2026-120195
CVE-2026-120195CRITICAL
WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection
48RISK
open ↗
Referência
CVE-2017-20263
CVE-2017-20263HIGH
Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location
41RISK
open ↗
Referência
CVE-2026-13579
CVE-2026-13579MEDIUM
itsourcecode Hospital Management System patientchangepassword.php sql injection
33RISK
open ↗
Referência
CVE-2026-120189
CVE-2026-120189CRITICAL
D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow
48RISK
open ↗
Referência✓ VexDay Proof
Ad Board - 'id' SQL Injection
CVE-2008-3725—webappsphp
SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2026-13486
CVE-2026-13486MEDIUM
SourceCodester Class and Exam Timetabling System preview6.php sql injection
33RISK
open ↗
Referência
CVE-2026-10823
CVE-2026-10823HIGH
YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure
56RISK
open ↗
← previouspage 847 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.