Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits

35,370CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecent popular risk

22,233 exploits

Referência

CVE-2016-10010

CVE-2016-10010HIGH

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which

41RISK

Referência

CVE-2016-1002

CVE-2016-1002—

Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577

28RISK

Referência

CVE-2010-0698

CVE-2010-0698—

SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitr

23RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10033

CVE-2016-10033CRITICALunder attack

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

Referência

CVE-2016-10045

CVE-2016-10045—

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

60RISK

Referência

CVE-2016-10074

CVE-2016-10074—

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass

35RISK

Referência

CVE-2016-10074

CVE-2016-10074—

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass

35RISK

Referência

CVE-2016-10074

CVE-2016-10074—

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass

35RISK

Referência

CVE-2026-8098

CVE-2026-8098MEDIUM

code-projects Feedback System checklogin.php sql injection

33RISK

Referência✓ VexDay Proof

Globsy 1.0 - 'file' Remote File Disclosure

CVE-2008-0905—webappsphp

Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a

23RISK

Referência✓ VexDay Proof

PHP-Nuke Module Docum - 'artid' SQL Injection

CVE-2008-0906—webappsphp

SQL injection vulnerability in the Docum module in PHP-Nuke allows remote attackers to execute arbitrary SQL commands vi

23RISK

Referência✓ VexDay Proof

PHP-Nuke Module Inhalt - 'cid' SQL Injection

CVE-2008-0907—webappsphp

SQL injection vulnerability in the Inhalt module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands

23RISK

Referência

CVE-2010-0721

CVE-2010-0721—

SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL comman

23RISK

Referência

CVE-2010-0721

CVE-2010-0721—

SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL comman

23RISK

Referência

CVE-2010-0722

CVE-2010-0722—

SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via

23RISK

Referência

CVE-2020-14750

CVE-2020-14750CRITICALunder attack

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISK

Referência✓ VexDay Proof

MultiCart 2.0 - 'productdetails.php' SQL Injection

CVE-2008-0911—webappsphp

SQL injection vulnerability in productdetails.php in iScripts MultiCart 2.0 allows remote authenticated users to execute

23RISK

Referência

CVE-2010-2613

CVE-2010-2613—

Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remo

23RISK

Referência

CVE-2010-2613

CVE-2010-2613—

Cross-site scripting (XSS) vulnerability in the JExtensions JE Awd Song (com_awd_song) component for Joomla! allows remo

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.