Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência
CVE-2012-4412
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
28RISK
open ↗Referência
CVE-2016-1713
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger
43RISK
open ↗Referência
CVE-2018-13784
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfi
28RISK
open ↗Referência
CVE-2015-1815
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to ex
28RISK
open ↗Referência
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI.
28RISK
open ↗Referência
CVE-2018-1418
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM
50RISK
open ↗Referência✓ VexDay Proof
WSN Links 2.20 - 'comments.php' SQL Injection
SQL injection vulnerability in comments.php in WSN Links 2.20 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2018-18761
SaltOS 3.1 r8126 allows action=login&querystring=&user=[SQL] SQL Injection.
28RISK
open ↗Referência
CVE-2020-27950
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watch
68RISK
open ↗Referência
CVE-2019-6974
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because
28RISK
open ↗Referência
CVE-2021-25161
A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in ve
43RISK
open ↗Referência✓ VexDay Proof
celerbb 0.0.2 - Multiple Vulnerabilities
login.php in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allows remote attackers to bypass authentication and obta
23RISK
open ↗Referência
CVE-2025-14706
Shiguangwu sgwbox N3 NETREBOOT http_eshell_server command injection
53RISK
open ↗Referência
CVE-2025-14707
Shiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injection
53RISK
open ↗Referência
CVE-2022-34047
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via v
43RISK
open ↗Referência
CVE-2009-4089
telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a mo
23RISK
open ↗Referência✓ VexDay Proof
PHP-Post 1.0 - Cookie Modification Privilege Escalation
PHP-Post 0.21 and 1.0, and possibly earlier versions, when auto-login is enabled, allows remote attackers to bypass secu
28RISK
open ↗Referência✓ VexDay Proof
SH-News 0.93 - 'misc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in misc.php in SH-News 0.93, when register_globals is enabled, allows remote att
23RISK
open ↗Referência
CVE-2013-2294
Multiple cross-site scripting (XSS) vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbi
23RISK
open ↗Referência
CVE-2014-2595
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a perm
28RISK
open ↗Referência
CVE-2017-6182
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports wa
28RISK
open ↗Referência
CVE-2017-7455
Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
28RISK
open ↗Referência
CVE-2022-47876
The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code v
48RISK
open ↗Referência✓ VexDay Proof
TaskFreak! 0.6.1 - SQL Injection
SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute ar
23RISK
open ↗Referência
CVE-2018-11220
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
28RISK
open ↗Referência✓ VexDay Proof
TribunaLibre 3.12 Beta - 'ftag.php' Remote File Inclusion
PHP remote file inclusion vulnerability in ftag.php in TribunaLibre 3.12 Beta allows remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
DomPHP 0.81 - 'cat' SQL Injection
Multiple SQL injection vulnerabilities in DomPHP 0.81 allow remote attackers to execute arbitrary SQL commands via the c
23RISK
open ↗Referência
CVE-2016-4136
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsof
28RISK
open ↗Referência
CVE-2017-7455
Moxa MXView 2.8 allows remote attackers to read web server's private key file, no access control.
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.