Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência
CVE-2014-8498
CVE-2014-8498—
SQL injection vulnerability in BulkEditSearchResult.cc in ManageEngine Password Manager Pro (PMP) and Password Manager P
28RISK
open ↗
Referência
CVE-2015-2826
CVE-2015-2826—
WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
28RISK
open ↗
Referência
CVE-2014-8675
CVE-2014-8675—
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which all
28RISK
open ↗
Referência
CVE-2019-15889
CVE-2019-15889MEDIUM
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by t
53RISK
open ↗
Referência
CVE-2017-5630
CVE-2017-5630—
PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenam
28RISK
open ↗
Referência
CVE-2015-5354
CVE-2015-5354—
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
43RISK
open ↗
Referência
CVE-2026-12910
CVE-2026-12910MEDIUM
Missing Authentication for Critical Function in GitLab
33RISK
open ↗
Referência
CVE-2016-2056
CVE-2016-2056—
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via
50RISK
open ↗
Referência✓ VexDay Proof
Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion
CVE-2008-6305—webappsphp
PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al
23RISK
open ↗
Referência
CVE-2026-65695
CVE-2026-65695HIGH
Office-Word-MCP-Server 1.1.11 Path Traversal via document tools
41RISK
open ↗
Referência
CVE-2016-2056
CVE-2016-2056—
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via
50RISK
open ↗
Referência
CVE-2009-2776
CVE-2009-2776—
SQL injection vulnerability in showresult.asp in Smart ASP Survey allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2018-19861
CVE-2018-19861—
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD re
28RISK
open ↗
Referência
CVE-2018-19861
CVE-2018-19861—
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD re
28RISK
open ↗
Referência
CVE-2019-19774
CVE-2019-19774—
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1 before Build 12110. By running "select hostdetai
28RISK
open ↗
Referência
CVE-2009-4733
CVE-2009-4733—
SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote att
23RISK
open ↗
Referência
CVE-2013-5045
CVE-2013-5045—
Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and conseque
43RISK
open ↗
Referência
CVE-2014-8675
CVE-2014-8675—
Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which all
28RISK
open ↗
Referência
CVE-2015-5354
CVE-2015-5354—
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
43RISK
open ↗
Referência
CVE-2018-11511
CVE-2018-11511—
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability
43RISK
open ↗
Referência
CVE-2008-6364
CVE-2008-6364—
SQL injection vulnerability in logon_process.jsp in Ad Server Solutions Banner Exchange Solution Java allows remote atta
23RISK
open ↗
Referência
CVE-2015-2196
CVE-2015-2196—
SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQ
43RISK
open ↗
Referência
CVE-2014-1903
CVE-2014-1903—
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12
50RISK
open ↗
Referência
CVE-2016-3861
CVE-2016-3861—
LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016
23RISK
open ↗
Referência
CVE-2017-1002001
CVE-2017-1002001—
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS so
28RISK
open ↗
Referência
CVE-2018-6460
CVE-2018-6460—
Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sen
28RISK
open ↗
Referência
CVE-2009-2883
CVE-2009-2883—
SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗
Referência
CVE-2019-8929
CVE-2019-8929—
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon
28RISK
open ↗
Referência
CVE-2026-90811
CVE-2026-90811MEDIUM
cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure
33RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption
CVE-2009-2176—webappsphp
Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, al
23RISK
open ↗
← previouspage 137 / 867next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.