Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,332 exploits
Referência
CVE-2026-10559
CVE-2026-10559MEDIUM
SourceCodester Pizzafy Ecommerce System index.php file inclusion
33RISK
open ↗
Referência
CVE-2026-10558
CVE-2026-10558MEDIUM
SourceCodester Pizzafy Ecommerce System index.php file inclusion
33RISK
open ↗
Referência
CVE-2018-25434
CVE-2018-25434HIGH
WP AutoSuggest 0.24 SQL Injection via autosuggest.php
41RISK
open ↗
Referência
CVE-2018-25433
CVE-2018-25433HIGH
Joomla JE Photo Gallery 1.1 SQL Injection via categoryid
41RISK
open ↗
Referência
CVE-2018-25432
CVE-2018-25432HIGH
Arm Whois 3.11 Buffer Overflow via ASLR Bypass
41RISK
open ↗
Referência
CVE-2026-10273
CVE-2026-10273MEDIUM
php-censor Webhook Endpoint GitBuild.php os command injection
33RISK
open ↗
Referência
CVE-2026-10270
CVE-2026-10270HIGH
D-Link DI-7001 MINI API httpd_debug.asp sprintf stack-based overflow
41RISK
open ↗
Referência
CVE-2026-10268
CVE-2026-10268MEDIUM
janet-lang janet marsh.c unmarshal_one_fiber integer overflow
33RISK
open ↗
Referência
CVE-2026-10267
CVE-2026-10267MEDIUM
janet-lang janet debug.c doframe out-of-bounds
33RISK
open ↗
Referência
CVE-2026-48559
CVE-2026-48559MEDIUM
Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags
33RISK
open ↗
Referência
CVE-2026-10260
CVE-2026-10260MEDIUM
CodeAstro Online Job Portal delete-jobs.php sql injection
33RISK
open ↗
Referência
CVE-2026-10259
CVE-2026-10259HIGH
H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow
41RISK
open ↗
Referência✓ VexDay Proof
F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service
CVE-2008-3447—dosmultiple
The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop)
23RISK
open ↗
Referência✓ VexDay Proof
eNdonesia 8.4 (Calendar Module) - SQL Injection
CVE-2008-3452—webappsphp
SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Insecure Cookie Handling
CVE-2008-3454—webappsphp
JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by se
23RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Remote File Inclusion
CVE-2008-3455—webappsphp
PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
Anzio Web Print Object 3.2.30 - ActiveX Buffer Overflow
CVE-2008-3480—remotewindows
Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Pri
28RISK
open ↗
Referência
CVE-2018-5974
CVE-2018-5974—
SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.
23RISK
open ↗
Referência✓ VexDay Proof
eStoreAff 0.1 - 'cid' SQL Injection
CVE-2008-3484—webappsphp
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid param
23RISK
open ↗
Referência✓ VexDay Proof
Scripts24 iPost 1.0.1 - 'id' SQL Injection
CVE-2008-3491—webappsphp
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Scripts24 iTGP 1.0.4 - 'id' SQL Injection
CVE-2008-3491—webappsphp
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
RealVNC Windows Client 4.1.2 - Remote Denial of Service Crash (PoC)
CVE-2008-3493—doswindows
vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application cras
23RISK
open ↗
Referência✓ VexDay Proof
MyPHP CMS 0.3.1 - 'pid' SQL Injection
CVE-2008-3497—webappsphp
SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
polypager 1.0rc2 - SQL Injection / Cross-Site Scripting
CVE-2008-3505—webappsphp
Cross-site scripting (XSS) vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência✓ VexDay Proof
LiteNews 0.1 - 'id' SQL Injection
CVE-2008-3507—webappsphp
SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers
23RISK
open ↗
Referência
CVE-2018-5983
CVE-2018-5983—
SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.
23RISK
open ↗
Referência✓ VexDay Proof
AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution
CVE-2008-3922—webappsphp
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences
50RISK
open ↗
Referência✓ VexDay Proof
CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory
CVE-2008-3923—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in statistics.php in Content Management Made Easy (CMME) 1.12 allow
23RISK
open ↗
Referência
CVE-2018-5984
CVE-2018-5984—
SQL Injection exists in the Tumder (An Arcade Games Platform) 2.1 component for Joomla! via the PATH_INFO to the categor
23RISK
open ↗
Referência✓ VexDay Proof
CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory
CVE-2008-3925—webappsphp
Cross-site request forgery (CSRF) vulnerability in admin.php in Content Management Made Easy (CMME) 1.12 allows remote a
23RISK
open ↗
← previouspage 499 / 745next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.