Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,233 exploits
Referência
CVE-2022-50992
CVE-2022-50992HIGH
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
41RISK
open ↗
Referência
CVE-2022-50992
CVE-2022-50992HIGH
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
41RISK
open ↗
Referência
CVE-2022-50993
CVE-2022-50993CRITICAL
Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet
48RISK
open ↗
Referência
CVE-2022-50993
CVE-2022-50993CRITICAL
Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet
48RISK
open ↗
Referência
CVE-2025-71284
CVE-2025-71284CRITICAL
Synway SMG Gateway Management Software OS Command Injection via radius_address
48RISK
open ↗
Referência
CVE-2010-4365
CVE-2010-4365—
SQL injection vulnerability in JE Ajax Event Calendar (com_jeajaxeventcalendar) component for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2010-4365
CVE-2010-4365—
SQL injection vulnerability in JE Ajax Event Calendar (com_jeajaxeventcalendar) component for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2010-4366
CVE-2010-4366—
Multiple cross-site scripting (XSS) vulnerabilities in forum_new_topic.php in Chameleon Social Networking allow remote a
23RISK
open ↗
Referência
CVE-2010-5016
CVE-2010-5016—
SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - Authentication Bypass
CVE-2008-6796—webappsphp
SQL injection vulnerability in manager/login.php in Pre Projects Pre Real Estate Listings allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - Arbitrary File Upload
CVE-2008-6798—webappsphp
Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
Tribiq CMS 5.0.9a (Beta) - Insecure Cookie Handling
CVE-2008-6804—webappsphp
Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the CO
23RISK
open ↗
Referência✓ VexDay Proof
7Shop 1.1 - Arbitrary File Upload
CVE-2008-6806—webappsphp
Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to e
23RISK
open ↗
Referência
CVE-2017-8656
CVE-2017-8656—
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code
35RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Link Directory - 'cat_id' SQL Injection
CVE-2008-6808—webappsphp
SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
Booking Centre 2.01 - 'HotelID' SQL Injection
CVE-2008-6809—webappsphp
SQL injection vulnerability in hotel_habitaciones.php in Venalsur Booking Centre Booking System for Hotels Group 2.01 al
23RISK
open ↗
Referência
CVE-2017-8671
CVE-2017-8671—
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary
35RISK
open ↗
Referência✓ VexDay Proof
Booking Centre 2.01 - Authentication Bypass
CVE-2008-6810—webappsphp
Multiple SQL injection vulnerabilities in admin/checklogin.php in Venalsur Booking Centre Booking System for Hotels Grou
23RISK
open ↗
Referência✓ VexDay Proof
PHPwebnews 0.2 MySQL Edition - 'det' SQL Injection
CVE-2008-6812—webappsphp
SQL injection vulnerability in bukutamu.php in phpWebNews 0.2 MySQL Edition allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Banner Manager - Insecure Cookie Handling
CVE-2008-6858—webappsphp
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by sett
23RISK
open ↗
Referência✓ VexDay Proof
Absolute Control Panel XE 1.5 - Insecure Cookie Handling
CVE-2008-6859—webappsphp
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative ac
23RISK
open ↗
Referência
CVE-2026-30368
CVE-2026-30368MEDIUM
A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersona
33RISK
open ↗
Referência
CVE-2026-26210
CVE-2026-26210CRITICAL
KTransformers Unsafe Deserialization RCE via balance_serve
48RISK
open ↗
Referência
CVE-2026-6942
CVE-2026-6942CRITICAL
radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
28RISK
open ↗
Referência
CVE-2026-6941
CVE-2026-6941MEDIUM
radare2 < 6.1.4 Project Notes Path Traversal via Symlink
13RISK
open ↗
Referência
CVE-2026-6940
CVE-2026-6940MEDIUM
radare2 < 6.1.4 Project Deletion Path Traversal Directory Deletion
13RISK
open ↗
Referência
CVE-2026-25874
CVE-2026-25874CRITICAL
LeRobot Unsafe Deserialization Remote Code Execution via gRPC
53RISK
open ↗
Referência
CVE-2026-23751
CVE-2026-23751CRITICAL
Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting
48RISK
open ↗
Referência
CVE-2026-41460
CVE-2026-41460CRITICAL
SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
48RISK
open ↗
Referência
CVE-2026-4512
CVE-2026-4512LOW
WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS
28RISK
open ↗
← previouspage 436 / 742next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.