Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência
CVE-2018-25428
CVE-2018-25428HIGH
Paroiciel 11.20 SQL Injection via tRecIdListe Parameter
41RISK
open ↗
Referência
CVE-2018-25427
CVE-2018-25427CRITICAL
Arm Whois 3.11 Buffer Overflow via SEH Overwrite
48RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Classifieds - 'cid' SQL Injection
CVE-2008-0873—webappsphp
SQL injection vulnerability in index.php in the jlmZone Classifieds module for XOOPS allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2013-5028
CVE-2013-5028—
SQL injection vulnerability in IT/hardware-list.dll in Kwoksys Kwok Information Server before 2.8.5 allows remote authen
23RISK
open ↗
Referência✓ VexDay Proof
RunCMS Module MyAnnonces - 'cid' SQL Injection
CVE-2008-0878—webappsphp
SQL injection vulnerability in index.php in the MyAnnonces 1.7 and earlier module for RunCMS allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-48559
CVE-2026-48559MEDIUM
Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags
33RISK
open ↗
Referência
CVE-2026-10260
CVE-2026-10260MEDIUM
CodeAstro Online Job Portal delete-jobs.php sql injection
33RISK
open ↗
Referência
CVE-2026-10259
CVE-2026-10259HIGH
H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow
41RISK
open ↗
Referência
CVE-2026-10258
CVE-2026-10258MEDIUM
itsourcecode Content Management System add_sub_topic.php sql injection
33RISK
open ↗
Referência
CVE-2013-5038
CVE-2013-5038—
The HOT HOTBOX router with software 2.1.11 allows remote attackers to bypass authentication by configuring a source IP a
23RISK
open ↗
Referência
CVE-2026-10249
CVE-2026-10249MEDIUM
itsourcecode Online Blood Bank Management System viewrequest.php sql injection
33RISK
open ↗
Referência
CVE-2026-10248
CVE-2026-10248MEDIUM
SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
33RISK
open ↗
Referência
CVE-2026-10247
CVE-2026-10247MEDIUM
SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting
33RISK
open ↗
Referência
CVE-2026-10246
CVE-2026-10246MEDIUM
SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting
33RISK
open ↗
Referência
CVE-2013-5045
CVE-2013-5045—
Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and conseque
43RISK
open ↗
Referência✓ VexDay Proof
PHP Download Manager 1.1 - Local File Inclusion
CVE-2008-1042—webappsphp
Directory traversal vulnerability in include/body.inc.php in Linux Web Shop (LWS) php Download Manager 1.0 and 1.1 allow
23RISK
open ↗
Referência✓ VexDay Proof
PHPProfiles 4.5.2 Beta - 'body_comm.inc.php' Remote File Inclusion
CVE-2008-1051—webappsphp
PHP remote file inclusion vulnerability in include/body_comm.inc.php in phpProfiles 4.5.2 BETA allows remote attackers t
28RISK
open ↗
Referência
CVE-2013-5220
CVE-2013-5220—
goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device
23RISK
open ↗
Referência
CVE-2008-1122
CVE-2008-1122—
SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5 - File Deletion/Creation
CVE-2008-1117—remotewindows
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RISK
open ↗
Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
CVE-2008-1117—remotewindows
Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu P
50RISK
open ↗
Referência✓ VexDay Proof
eazyPortal 1.0 - 'cookie' SQL Injection
CVE-2008-1121—webappsphp
SQL injection vulnerability in index.php in eazyPortal 1.0 and earlier allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Dream4 Koobi Pro 5.7 - 'categ' SQL Injection
CVE-2008-1122—webappsphp
SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2011-1048
CVE-2011-1048—
SQL injection vulnerability in product.php in MihanTools 1.33 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2026-8743
CVE-2026-8743MEDIUM
Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization
33RISK
open ↗
Referência
CVE-2026-8741
CVE-2026-8741LOW
EMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race condition
28RISK
open ↗
Referência
CVE-2026-8740
CVE-2026-8740MEDIUM
Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine
33RISK
open ↗
Referência
CVE-2026-8739
CVE-2026-8739MEDIUM
Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key
33RISK
open ↗
Referência
CVE-2026-8738
CVE-2026-8738MEDIUM
Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error
33RISK
open ↗
Referência
CVE-2026-8737
CVE-2026-8737MEDIUM
Sanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authentication
33RISK
open ↗
← previouspage 299 / 724next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.