Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência
CVE-2019-3921
CVE-2019-3921—
The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via
28RISK
open ↗
Referência
CVE-2023-30803
CVE-2023-30803CRITICAL
Sangfor Next-Gen Application Firewall Authentication Bypass
53RISK
open ↗
Referência
CVE-2017-2988
CVE-2017-2988—
Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable memory corruption vulnerability when performing g
28RISK
open ↗
Referência
CVE-2022-4120
CVE-2022-4120CRITICAL
Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection
53RISK
open ↗
Referência
CVE-2026-109182
CVE-2026-109182MEDIUM
jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
33RISK
open ↗
Referência
CVE-2021-3156
CVE-2021-3156HIGHunder attack
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
Referência
CVE-2022-46552
CVE-2022-46552HIGH
D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan
46RISK
open ↗
Referência
CVE-2026-16298
CVE-2026-16298CRITICAL
FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset
48RISK
open ↗
Referência✓ VexDay Proof
Technote 7.2 - Remote File Inclusion
CVE-2009-0441—webappsphp
PHP remote file inclusion vulnerability in skin_shop/standard/2_view_body/body_default.php in TECHNOTE 7.2, when registe
23RISK
open ↗
Referência
CVE-2010-0978
CVE-2010-0978—
KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which
23RISK
open ↗
Referência
CVE-2015-5130
CVE-2015-5130—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linu
35RISK
open ↗
Referência
CVE-2016-2207
CVE-2016-2207—
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
28RISK
open ↗
Referência
CVE-2018-15142
CVE-2018-15142—
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authent
28RISK
open ↗
Referência
CVE-2026-19229
CVE-2026-19229MEDIUM
SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure
33RISK
open ↗
Referência
CVE-2017-7308
CVE-2017-7308—
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
43RISK
open ↗
Referência
CVE-2018-1321
CVE-2018-1321—
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
28RISK
open ↗
Referência
CVE-2026-109180
CVE-2026-109180MEDIUM
jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
33RISK
open ↗
Referência
CVE-2018-18323
CVE-2018-18323—
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/
60RISK
open ↗
Referência
CVE-2018-19423
CVE-2018-19423—
Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
28RISK
open ↗
Referência
CVE-2022-31101
CVE-2022-31101HIGH
SQL Injection in prestashop/blockwishlist
61RISK
open ↗
Referência
CVE-2026-18030
CVE-2026-18030HIGH
Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
41RISK
open ↗
Referência✓ VexDay Proof
WholeHogSoftware Ware Support - Insecure Cookie Handling
CVE-2009-0460—webappsphp
Whole Hog Ware Support 1.x allows remote attackers to bypass authentication and obtain administrative access via an inte
23RISK
open ↗
Referência
CVE-2009-3965
CVE-2009-3965—
SQL injection vulnerability in rating.php in New 5 star Rating 1.0 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2010-2091
CVE-2010-2091—
Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly
28RISK
open ↗
Referência✓ VexDay Proof
FreeForum 0.9.7 - 'forum.php' Remote File Inclusion
CVE-2006-5230—webappsphp
PHP remote file inclusion vulnerability in forum.php in FreeForum 0.9.7 and earlier allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2009-4574
CVE-2009-4574—
SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2009-3972
CVE-2009-3972—
SQL injection vulnerability in the Q-Proje Siirler Bileseni (com_siirler) component 1.2 RC for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2010-1067
CVE-2010-1067—
E-membres 1.0 stores sensitive information under the web root with insufficient access control, which allows remote atta
23RISK
open ↗
Referência
CVE-2010-1955
CVE-2010-1955—
Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2015-3089
CVE-2015-3089—
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460
35RISK
open ↗
← previouspage 133 / 867next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.