Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,332 exploits
Referência
CVE-2026-18613
CVE-2026-18613CRITICAL
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection
48RISK
open ↗
Referência
CVE-2026-18612
CVE-2026-18612CRITICAL
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
48RISK
open ↗
Referência
CVE-2026-61523
CVE-2026-61523HIGH
WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor
41RISK
open ↗
Referência
CVE-2026-18610
CVE-2026-18610MEDIUM
NewType WebEIP EIP_Com_FileList.aspx improper authentication
33RISK
open ↗
Referência✓ VexDay Proof
WebStudio eCatalogue - Blind SQL Injection
CVE-2008-5294—webappsphp
SQL injection vulnerability in index.php in WebStudio eCatalogue allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
PG Real Estate - Authentication Bypass
CVE-2008-5306—webappsphp
SQL injection vulnerability in admin/index.php in PG Real Estate Solution allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
LoveCMS 1.6.2 Final (Simple Forum 3.1d) - Change Admin Password
CVE-2008-5308—webappsphp
The Simple Forum 3.1d module for LoveCMS 1.6.2 Final does not properly restrict access to administrator functions, which
23RISK
open ↗
Referência✓ VexDay Proof
e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection
CVE-2008-5320—webappsphp
SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute
23RISK
open ↗
Referência
CVE-2018-6941
CVE-2018-6941—
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remot
23RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module GesGaleri - SQL Injection
CVE-2008-5321—webappsphp
SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo
CVE-2008-5322—webappsphp
Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, wh
23RISK
open ↗
Referência✓ VexDay Proof
Wysi Wiki Wyg 1.0 - Local File Inclusion / Cross-Site Scripting / PHPInfo
CVE-2008-5323—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência✓ VexDay Proof
Nitrotech 0.0.3a - Remote File Inclusion / SQL Injection
CVE-2008-5334—webappsphp
PHP remote file inclusion vulnerability in includes/common.php in NitroTech 0.0.3a allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion 7.00.1 - 'messages.php' SQL Injection
CVE-2008-5335—webappsphp
SQL injection vulnerability in messages.php in PHP-Fusion 6.01.15 and 7.00.1, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
yahoo answers - 'id' SQL Injection
CVE-2008-5490—webappsphp
SQL injection vulnerability in index.php in PHPStore Yahoo Answers allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
SlimCMS 1.0.0 - 'edit.php' SQL Injection
CVE-2008-5491—webappsphp
SQL injection vulnerability in edit.php in SlimCMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência✓ VexDay Proof
VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)
CVE-2008-5492—doswindows
Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX
50RISK
open ↗
Referência✓ VexDay Proof
PHPstore Wholesale - 'id' SQL Injection
CVE-2008-5493—webappsphp
SQL injection vulnerability in track.php in PHPStore Wholesales (aka Wholesale) allows remote attackers to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component Contact Info 1.0 - SQL Injection
CVE-2008-5494—webappsphp
SQL injection vulnerability in the Contact Information Module (com_contactinfo) component 1.0 for Joomla! allows remote
23RISK
open ↗
Referência✓ VexDay Proof
PozScripts Business Directory Script - 'cid' SQL Injection
CVE-2008-5496—webappsphp
SQL injection vulnerability in showcategory.php in PozScripts Business Directory Script allows remote attackers to execu
23RISK
open ↗
Referência✓ VexDay Proof
Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities
CVE-2008-5518—remotemultiple
Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1
35RISK
open ↗
Referência✓ VexDay Proof
postecards - SQL Injection / File Disclosure
CVE-2008-5559—webappsasp
SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência✓ VexDay Proof
postecards - SQL Injection / File Disclosure
CVE-2008-5560—webappsasp
PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attacke
23RISK
open ↗
Referência
CVE-2018-7203
CVE-2018-7203—
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Netref 4.0 - Multiple SQL Injections
CVE-2008-5561—webappsphp
SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter
23RISK
open ↗
Referência
CVE-2018-7203
CVE-2018-7203—
Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
DL PayCart 1.34 - Admin Password Changing
CVE-2008-5565—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
Bonza Cart 1.10 - Admin Password Changing
CVE-2008-5567—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote at
23RISK
open ↗
Referência✓ VexDay Proof
IPNPro3 < 1.44 - Admin Password Changing
CVE-2008-5568—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Professional Download Assistant 0.1 - Authentication Bypass
CVE-2008-5571—webappsasp
SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute
23RISK
open ↗
← previouspage 494 / 745next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.