Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência
CVE-2023-27823
CVE-2023-27823CRITICAL
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid cr
60RISK
open ↗
Referência
CVE-2026-105096
CVE-2026-105096MEDIUM
Omega Solution CoinEx Crypto Customer Profile API customer authorization
33RISK
open ↗
Referência
CVE-2026-104983
CVE-2026-104983MEDIUM
Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
33RISK
open ↗
Referência
CVE-2020-9496
CVE-2020-9496—
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
60RISK
open ↗
Referência
CVE-2009-3196
CVE-2009-3196—
Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2011-0519
CVE-2011-0519—
SQL injection vulnerability in gallery.php in Gallarific PHP Photo Gallery script 2.1 and possibly other versions allows
23RISK
open ↗
Referência
CVE-2015-2125
CVE-2015-2125—
Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to by
23RISK
open ↗
Referência✓ VexDay Proof
MTCMS 2.0 - '/admin/admin_settings.php' Remote File Inclusion
CVE-2006-6796—webappsphp
PHP remote file inclusion vulnerability in admin/admin_settings.php in MTCMS 2.0 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2004-1720
CVE-2004-1720—
The (1) address.html and possibly (2) calendar.html pages in Merak Mail Server 5.2.7 allow remote attackers to gain sens
23RISK
open ↗
Referência
CVE-2008-4178
CVE-2008-4178—
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and D
23RISK
open ↗
Referência
CVE-2009-3311
CVE-2009-3311—
Cross-site scripting (XSS) vulnerability in index.php in RSSMediaScript allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
Mini Web Calendar 1.2 - File Disclosure / Cross-Site Scripting
CVE-2008-5062—webappsphp
Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read ar
23RISK
open ↗
Referência
CVE-2014-7910
CVE-2014-7910—
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RISK
open ↗
Referência
CVE-2017-14086
CVE-2017-14086—
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated u
23RISK
open ↗
Referência
CVE-2016-9813
CVE-2016-9813—
The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of ser
23RISK
open ↗
Referência
CVE-2018-13042
CVE-2018-13042—
The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com
23RISK
open ↗
Referência
CVE-2022-30525
CVE-2022-30525CRITICALunder attack
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗
Referência
CVE-2022-30525
CVE-2022-30525CRITICALunder attack
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗
Referência
CVE-2010-1953
CVE-2010-1953—
Directory traversal vulnerability in the iNetLanka Multiple Map (com_multimap) component 1.0 for Joomla! allows remote a
43RISK
open ↗
Referência✓ VexDay Proof
PHPmotion 2.1 - Cross-Site Request Forgery
CVE-2008-6729—webappsphp
Multiple cross-site request forgery (CSRF) vulnerabilities in password.php in PHPmotion 2.1 and earlier allow remote att
23RISK
open ↗
Referência
CVE-2009-3324
CVE-2009-3324—
PHP remote file inclusion vulnerability in include/prodler.class.php in ProdLer 2.0 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Ananda Real Estate 3.4 - 'agent' SQL Injection
CVE-2006-6807—webappsasp
SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier all
23RISK
open ↗
Referência
CVE-2009-3328
CVE-2009-3328—
Cross-site scripting (XSS) vulnerability in sign.php in WX-Guestbook 1.1.208 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2017-14086
CVE-2017-14086—
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated u
23RISK
open ↗
Referência
CVE-2026-103514
CVE-2026-103514HIGH
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay
41RISK
open ↗
Referência
CVE-2026-103293
CVE-2026-103293MEDIUM
MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import
33RISK
open ↗
Referência
CVE-2017-6193
CVE-2017-6193—
Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arb
23RISK
open ↗
Referência
CVE-2013-1806
CVE-2013-1806—
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include an
23RISK
open ↗
Referência
CVE-2018-10608
CVE-2018-10608—
SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects
23RISK
open ↗
Referência
CVE-2020-10387
CVE-2020-10387—
Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files
23RISK
open ↗
← previouspage 142 / 867next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.