Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência✓ VexDay Proof
CS-Cart 1.3.3 - 'classes_dir' Remote File Inclusion
CVE-2006-2863—webappsphp
PHP remote file inclusion vulnerability in class.cs_phpmailer.php in CS-Cart 1.3.3 allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Internet PhotoShow 1.3 - 'page' Remote File Inclusion
CVE-2006-1919—webappsphp
PHP remote file inclusion vulnerability in index.php in Internet Photoshow 1.3 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
XM Easy Personal FTP Server 1.0 - 'Port' Remote Overflow (PoC)
CVE-2006-2226—doswindows
Buffer overflow in XM Easy Personal FTP Server 4.2 and 5.0.1 allows remote authenticated users to cause a denial of serv
23RISK
open ↗
Referência
CVE-2026-13729
CVE-2026-13729MEDIUM
Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
33RISK
open ↗
Referência
CVE-2026-11881
CVE-2026-11881MEDIUM
Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field
33RISK
open ↗
Referência
CVE-2026-111031
CVE-2026-111031MEDIUM
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter
33RISK
open ↗
Referência
CVE-2026-117606
CVE-2026-117606MEDIUM
NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
33RISK
open ↗
Referência
CVE-2026-117557
CVE-2026-117557MEDIUM
SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader
33RISK
open ↗
Referência
CVE-2026-116339
CVE-2026-116339MEDIUM
iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist
33RISK
open ↗
Referência
CVE-2026-116274
CVE-2026-116274MEDIUM
JIZHICMS Front-end Order OrderController.php pay improper authorization
33RISK
open ↗
Referência
CVE-2026-103299
CVE-2026-103299MEDIUM
nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret
33RISK
open ↗
Referência
CVE-2026-103319
CVE-2026-103319MEDIUM
OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key
33RISK
open ↗
Referência✓ VexDay Proof
TagIt! Tagboard 2.1.b b2 - 'index.php' Remote File Inclusion
CVE-2006-5093—webappsphp
PHP remote file inclusion vulnerability in index.php in Tagmin Control Center in TagIt! Tagboard 2.1.B Build 2 allows re
23RISK
open ↗
Referência✓ VexDay Proof
NaviCOPA Web Server 2.01 - 'GET' Remote Buffer Overflow
CVE-2006-5112—remotewindows
Buffer overflow in InterVations NaviCOPA Web Server 2.01 allows remote attackers to execute arbitrary code via a long HT
50RISK
open ↗
Referência✓ VexDay Proof
CS-Gallery 2.0 - 'index.php?album' Remote File Inclusion
CVE-2007-1108—webappsphp
PHP remote file inclusion vulnerability in index.php in Christian Schneider CS-Gallery 2.0 and earlier allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
GaziYapBoz Game Portal - 'kategori.asp' SQL Injection
CVE-2007-1410—webappsasp
SQL injection vulnerability in kategori.asp in GaziYapBoz Game Portal allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
ActSoft DVD-Tools - 'dvdtools.ocx' Remote Buffer Overflow
CVE-2007-0976—remotewindows
Buffer overflow in the ActSoft DVD-Tools ActiveX control (dvdtools.ocx) allows remote attackers to execute arbitrary cod
23RISK
open ↗
Referência
CVE-2026-66752
CVE-2026-66752MEDIUM
tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
33RISK
open ↗
Referência✓ VexDay Proof
HC Newssystem 1.0-1.4 - 'index.php?ID' SQL Injection
CVE-2007-1417—webappsphp
SQL injection vulnerability in index.php in HC NEWSSYSTEM 1.0-4 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
work system E-Commerce 3.0.5 - Remote File Inclusion
CVE-2007-1423—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WORK system e-commerce 3.0.5 and earlier allow remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Module NoMoKeTos Rules 0.0.1 - Remote File Inclusion
CVE-2007-1106—webappsphp
PHP remote file inclusion vulnerability in includes/functions_nomoketos_rules.php in the NoMoKeTos Rules 0.0.1 module fo
23RISK
open ↗
Referência✓ VexDay Proof
WebCalendar 0.9.45 - 'includedir' Remote File Inclusion
CVE-2007-1483—webappsphp
Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
xoops module tinycontent 1.5 - Remote File Inclusion
CVE-2007-3237—webappsphp
PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the TinyContent 1.5 module for XOOPS all
35RISK
open ↗
Referência✓ VexDay Proof
Particle Gallery 1.0.1 - SQL Injection
CVE-2007-3065—webappsphp
SQL injection vulnerability in viewimage.php in Particle Soft Particle Gallery 1.0.1 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Musoo 0.21 - Remote File Inclusion
CVE-2007-3297—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗
Referência✓ VexDay Proof
JBlog 1.0 - Create / Delete Admin Authentication Bypass
CVE-2007-3973—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in JBlog 1.0 allow remote attackers to inject arbitrary web script o
23RISK
open ↗
Referência✓ VexDay Proof
bwired - 'index.php?newsID' SQL Injection
CVE-2007-3977—webappsphp
Cross-site scripting (XSS) vulnerability in bwired allows remote attackers to inject arbitrary web script or HTML via un
23RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.7/5.2.3 - MySQL/MySQLi 'Safe_Mode' Bypass
CVE-2007-3997—localmultiple
The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass
28RISK
open ↗
Referência✓ VexDay Proof
Webyapar 2.0 - Multiple SQL Injections
CVE-2007-4068—webappsphp
Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗
Referência✓ VexDay Proof
Softbiz Recipes Portal Script - SQL Injection
CVE-2007-5449—webappsphp
SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbi
23RISK
open ↗
← previouspage 875 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.