Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
25,989 exploits
Referência
CVE-2010-1659
CVE-2010-1659—
Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows rem
43RISK
open ↗
Referência
CVE-2010-2351
CVE-2010-2351—
Stack-based buffer overflow in the CIFS.NLM driver in Netware SMB 1.0 for Novell Netware 6.5 SP8 and earlier allows remo
28RISK
open ↗
Referência
CVE-2017-0211
CVE-2017-0211—
An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows
28RISK
open ↗
Referência
CVE-2023-0913
CVE-2023-0913MEDIUM
SourceCodester Auto Dealer Management System sql injection
33RISK
open ↗
Referência
CVE-2010-2891
CVE-2010-2891—
Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute ar
28RISK
open ↗
Referência
CVE-2010-2356
CVE-2010-2356—
Cross-site scripting (XSS) vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
phpBB Spider Friendly Module 1.3.10 - Remote File Inclusion
CVE-2006-5665—webappsphp
PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier
23RISK
open ↗
Referência
CVE-2010-1337
CVE-2010-1337—
Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla 1.1.10, and possibly 0.9.2 and
23RISK
open ↗
Referência
CVE-2015-2068
CVE-2015-2068—
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a
43RISK
open ↗
Referência
CVE-2017-9353
CVE-2017-9353—
In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed in epan/dissectors/packet-ipv6.c by vali
28RISK
open ↗
Referência
CVE-2015-3088
CVE-2015-3088—
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows an
35RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
CVE-2008-6237—webappsphp
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RISK
open ↗
Referência
CVE-2013-6127
CVE-2013-6127—
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53
28RISK
open ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RISK
open ↗
Referência
CVE-2018-4237
CVE-2018-4237—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RISK
open ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RISK
open ↗
Referência
CVE-2017-10246
CVE-2017-10246—
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Suppo
28RISK
open ↗
Referência
CVE-2020-5726
CVE-2020-5726—
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem
23RISK
open ↗
Referência
CVE-2018-1218
CVE-2018-1218—
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the '
28RISK
open ↗
Referência
CVE-2026-90687
CVE-2026-90687MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
33RISK
open ↗
Referência✓ VexDay Proof
Simple Customer 1.3 - Arbitrary Change Admin Password
CVE-2009-1637—webappsphp
profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to chan
23RISK
open ↗
Referência
CVE-2019-1149
CVE-2019-1149HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RISK
open ↗
Referência
CVE-2019-3810
CVE-2019-3810MEDIUM
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported vers
38RISK
open ↗
Referência
CVE-2026-90686
CVE-2026-90686MEDIUM
GPAC MP4Box loader_bt.c gf_bt_report memory corruption
33RISK
open ↗
Referência
CVE-2026-90685
CVE-2026-90685LOW
GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
28RISK
open ↗
Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
CVE-2006-5676—webappsasp
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2013-3526
CVE-2013-3526—
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earli
43RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
CVE-2007-1401—localwindows
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RISK
open ↗
Referência
CVE-2017-11152
CVE-2017-11152—
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
28RISK
open ↗
Referência
CVE-2026-86240
CVE-2026-86240MEDIUM
liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery
33RISK
open ↗
← previouspage 151 / 867next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.