Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência
CVE-2018-0834
CVE-2018-0834—
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot
35RISK
open ↗
Referência✓ VexDay Proof
pHNews Alpha 1 - 'genbackup.php' Database Disclosure
CVE-2009-0866—webappsphp
pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote att
23RISK
open ↗
Referência
CVE-2010-0943
CVE-2010-0943—
Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to r
43RISK
open ↗
Referência
CVE-2010-1532
CVE-2010-1532—
Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remo
43RISK
open ↗
Referência
CVE-2010-4931
CVE-2010-4931—
Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary
28RISK
open ↗
Referência✓ VexDay Proof
IBM Director 5.20.3su2 CIM Server - Remote Denial of Service
CVE-2009-0879—doswindows
The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of se
23RISK
open ↗
Referência
CVE-2009-4977
CVE-2009-4977—
PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbi
23RISK
open ↗
Referência
CVE-2015-5065
CVE-2015-5065—
Absolute path traversal vulnerability in proxy.php in the google currency lookup in the Paypal Currency Converter Basic
28RISK
open ↗
Referência
CVE-2017-6206
CVE-2017-6206—
D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28, and DGS-1510-20 Websmart devi
28RISK
open ↗
Referência
CVE-2013-2501
CVE-2013-2501—
Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attacker
23RISK
open ↗
Referência
CVE-2020-11749
CVE-2020-11749—
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator
28RISK
open ↗
Referência
CVE-2015-4666
CVE-2015-4666—
Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attack
43RISK
open ↗
Referência
CVE-2026-84166
CVE-2026-84166MEDIUM
Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF
33RISK
open ↗
Referência
CVE-2009-4140
CVE-2009-4140—
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer
60RISK
open ↗
Referência
CVE-2017-1000251
CVE-2017-1000251—
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and includ
28RISK
open ↗
Referência
CVE-2019-18396
CVE-2019-18396—
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Comm
28RISK
open ↗
Referência
CVE-2020-5330
CVE-2020-5330HIGH
Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22
46RISK
open ↗
Referência
CVE-2009-4140
CVE-2009-4140—
Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer
60RISK
open ↗
Referência
CVE-2011-0501
CVE-2011-0501—
Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions all
28RISK
open ↗
Referência
CVE-2011-4362
CVE-2011-4362—
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttp
28RISK
open ↗
Referência
CVE-2019-7262
CVE-2019-7262—
Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF).
28RISK
open ↗
Referência
CVE-2013-2567
CVE-2013-2567—
An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded
28RISK
open ↗
Referência✓ VexDay Proof
eboli - 'index.php' Remote File Inclusion
CVE-2006-5317—webappsphp
PHP remote file inclusion vulnerability in index.php in eboli allows remote attackers to execute arbitrary PHP code via
23RISK
open ↗
Referência
CVE-2015-4666
CVE-2015-4666—
Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attack
43RISK
open ↗
Referência
CVE-2009-4203
CVE-2009-4203—
Multiple SQL injection vulnerabilities in admin/aclass/admin_func.php in Arab Portal 2.2 allow remote attackers to execu
23RISK
open ↗
Referência
CVE-2022-48110
CVE-2022-48110MEDIUM
CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CK
33RISK
open ↗
Referência
CVE-2026-108802
CVE-2026-108802MEDIUM
y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting
33RISK
open ↗
Referência
CVE-2010-1929
CVE-2010-1929—
Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll
28RISK
open ↗
Referência
CVE-2013-7137
CVE-2013-7137—
The "remember me" functionality in login.php in Burden before 1.8.1 allows remote attackers to bypass authentication and
28RISK
open ↗
Referência
CVE-2017-6971
CVE-2017-6971—
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary comma
28RISK
open ↗
← previouspage 139 / 867next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.