Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
25,887 exploits
Referência
CVE-2009-3971
CVE-2009-3971—
SQL injection vulnerability in the jTips (com_jtips) component 1.0.7 and 1.0.9 for Joomla! allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2012-5877
CVE-2012-5877—
Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and cr
23RISK
open ↗
Referência
CVE-2014-8768
CVE-2014-8768—
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RISK
open ↗
Referência
CVE-2014-8768
CVE-2014-8768—
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RISK
open ↗
Referência
CVE-2018-9022
CVE-2018-9022—
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to exec
28RISK
open ↗
Referência
CVE-2026-82524
CVE-2026-82524HIGH
UnoPim File Upload RCE via TinyMCE Image Upload Endpoint
41RISK
open ↗
Referência
CVE-2019-0573
CVE-2019-0573—
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations,
28RISK
open ↗
Referência
CVE-2018-13416
CVE-2018-13416—
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML Extern
28RISK
open ↗
Referência
CVE-2018-5726
CVE-2018-5726—
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request,
28RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-7056—webappsphp
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain
23RISK
open ↗
Referência
CVE-2020-24881
CVE-2020-24881—
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
60RISK
open ↗
Referência
CVE-2018-6006
CVE-2018-6006—
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
28RISK
open ↗
Referência
CVE-2021-24946
CVE-2021-24946—
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
60RISK
open ↗
Referência
CVE-2026-49950
CVE-2026-49950CRITICAL
Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
48RISK
open ↗
Referência
CVE-2026-104085
CVE-2026-104085HIGH
odt2spip < 4.4.0 OS Command Injection via Document Filename
41RISK
open ↗
Referência
CVE-2026-92463
CVE-2026-92463HIGH
yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
41RISK
open ↗
Referência
CVE-2015-5568
CVE-2015-5568—
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Ad
28RISK
open ↗
Referência
CVE-2016-3387
CVE-2016-3387—
Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which al
28RISK
open ↗
Referência
CVE-2017-16921
CVE-2017-16921—
In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.2
28RISK
open ↗
Referência
D-Link DIR-615 Wireless Router  -  Persistent Cross-Site Scripting
CVE-2019-19742—webappshardware
On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
28RISK
open ↗
Referência✓ VexDay Proof
Maxum Rumpus 6.0 - Multiple Remote Buffer Overflow Vulnerabilities
CVE-2008-7078—doswindows
Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation f
23RISK
open ↗
Referência
CVE-2022-31161
CVE-2022-31161CRITICAL
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
68RISK
open ↗
Referência
CVE-2026-108376
CVE-2026-108376HIGH
dataclasses-avroschema allows code injection through record names in generated default factories
41RISK
open ↗
Referência
CVE-2026-110113
CVE-2026-110113MEDIUM
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
33RISK
open ↗
Referência
CVE-2010-3187
CVE-2010-3187—
Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST com
28RISK
open ↗
Referência
CVE-2009-2439
CVE-2009-2439—
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
bcoos 1.0.10 - Local File Inclusion / SQL Injection
CVE-2007-6080—webappsphp
SQL injection vulnerability in modules/banners/click.php in the banners module for bcoos 1.0.10 allows remote attackers
23RISK
open ↗
Referência
CVE-2010-3187
CVE-2010-3187—
Buffer overflow in ftpd in IBM AIX 5.3 and earlier allows remote attackers to execute arbitrary code via a long NLST com
28RISK
open ↗
Referência
CVE-2013-1814
CVE-2013-1814—
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain s
60RISK
open ↗
Referência
CVE-2021-21148
CVE-2021-21148HIGHunder attack
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap
76RISK
open ↗
← previouspage 127 / 863next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.