Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
26,041 exploits
Referência
CVE-2018-9118
CVE-2018-9118—
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Direct
50RISK
open ↗
Referência✓ VexDay Proof
Plaincart 1.1.2 - 'p' SQL Injection
CVE-2008-6469—webappsphp
SQL injection vulnerability in index.php in PlainCart 1.1.2 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2009-2477
CVE-2009-2477—
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1
50RISK
open ↗
Referência
CVE-2009-2477
CVE-2009-2477—
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1
50RISK
open ↗
Referência
CVE-2021-27878
CVE-2021-27878HIGHunder attackransomware
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires suc
91RISK
open ↗
Referência
CVE-2014-2996
CVE-2014-2996—
XCloner Standalone 3.5 and earlier, when enable_db_backup and sql_mem are enabled, allows remote authenticated administr
23RISK
open ↗
Referência
CVE-2010-0980
CVE-2010-0980—
SQL injection vulnerability in player.php in Left 4 Dead (L4D) Stats 1.1 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2019-11013
CVE-2019-11013—
Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow
43RISK
open ↗
Referência
CVE-2018-5997
CVE-2018-5997—
An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a pa
28RISK
open ↗
Referência
CVE-2019-12922
CVE-2019-12922—
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
28RISK
open ↗
Referência
CVE-2026-110763
CVE-2026-110763MEDIUM
lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
33RISK
open ↗
Referência
CVE-2009-2477
CVE-2009-2477—
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1
50RISK
open ↗
Referência
CVE-2010-0981
CVE-2010-0981—
SQL injection vulnerability in the TPJobs (com_tpjobs) component for Joomla! allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2010-3601
CVE-2010-3601—
SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
Helix Server 11.0.1 (Windows 2000 SP4) - Remote Heap Overflow
CVE-2006-6026—remotewindows
Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.
28RISK
open ↗
Referência
CVE-2016-4340
CVE-2016-4340—
The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8
28RISK
open ↗
Referência
CVE-2014-8322
CVE-2014-8322—
Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attac
28RISK
open ↗
Referência
CVE-2017-15048
CVE-2017-15048—
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
28RISK
open ↗
Referência
CVE-2015-7247
CVE-2015-7247—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and
28RISK
open ↗
Referência✓ VexDay Proof
easyLink 1.1.0 - 'detail.php' SQL Injection
CVE-2008-6471—webappsphp
SQL injection vulnerability in detail.php in MountainGrafix easyLink 1.1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2017-7117
CVE-2017-7117—
An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud befor
28RISK
open ↗
Referência
CVE-2013-6877
CVE-2013-6877—
Heap-based buffer overflow in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738
28RISK
open ↗
Referência
CVE-2009-2479
CVE-2009-2479—
Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exceptio
28RISK
open ↗
Referência
CVE-2009-4871
CVE-2009-4871—
SQL injection vulnerability in globepersonnel_forum.asp in Logoshows BBS 2.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2010-1056
CVE-2010-1056—
Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remot
43RISK
open ↗
Referência
CVE-2010-1056
CVE-2010-1056—
Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remot
43RISK
open ↗
Referência
CVE-2016-4340
CVE-2016-4340—
The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8
28RISK
open ↗
Referência
CVE-2020-7030
CVE-2020-7030MEDIUM
IPO Information Disclosure
33RISK
open ↗
Referência
CVE-2026-114249
CVE-2026-114249MEDIUM
dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
33RISK
open ↗
Referência
CVE-2017-15048
CVE-2017-15048—
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
28RISK
open ↗
← previouspage 158 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.