Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
24,485 exploits
Exploit-DB
FoxCMS 1.2.5 - Remote Code Execution (RCE)
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗Exploit-DB
Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
75RISK
open ↗Exploit-DB
KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
61RISK
open ↗Exploit-DB
Apache Commons Text 1.10.0 - Remote Code Execution
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
open ↗Exploit-DB
Langflow 1.3.0 - Remote Code Execution (RCE)
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISK
open ↗Exploit-DB
Inventio Lite 4 - SQL Injection
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action
48RISK
open ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
TP-Link VN020 F3v(T) FTP USER Command memory corruption
33RISK
open ↗Exploit-DB
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISK
open ↗Exploit-DB
compop.ca 3.5.3 - Arbitrary code Execution
An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and t
48RISK
open ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
41RISK
open ↗Exploit-DB
Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery
33RISK
open ↗Exploit-DB
ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution
Unauthorized Access
48RISK
open ↗Exploit-DB
Usermin 2.100 - Username Enumeration
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid
48RISK
open ↗Exploit-DB
ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)
Cross Side Request Forgery, CSRF
41RISK
open ↗Exploit-DB
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
33RISK
open ↗Exploit-DB
Car Rental Project 1.0 - Remote Code Execution
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile ima
23RISK
open ↗Exploit-DB
Smart Manager 8.27.0 - Post-Authenticated SQL Injection
Smart Manager < 8.28.0 - Admin+ SQL Injection
41RISK
open ↗Exploit-DB
FLIR AX8 1.46.16 - Remote Command Injection
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RISK
open ↗Exploit-DB
Garage Management System 1.0 (categoriesName) - Stored XSS
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary
33RISK
open ↗Exploit-DB
WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core
41RISK
open ↗Exploit-DB
ProConf 6.0 - Insecure Direct Object Reference (IDOR)
In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows any author to view and grab all submitted paper
23RISK
open ↗Exploit-DB
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
48RISK
open ↗Exploit-DB
NagVis 1.9.33 - Arbitrary File Read
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagV
48RISK
open ↗Exploit-DB
Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE)
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability
41RISK
open ↗Exploit-DB
WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection
WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection
41RISK
open ↗Exploit-DB
Dell EMC iDRAC7/iDRAC8 2.52.52.52 - Remote Code Execution (RCE)
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute
60RISK
open ↗Exploit-DB
Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
41RISK
open ↗Exploit-DB
Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.