Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits

40,156CVEs with public exploitation

24,696lab-tested

All Referência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecent popular risk

26,041 exploits

Referência

CVE-2015-6567

CVE-2015-6567—

Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/

28RISK

open ↗

Referência

CVE-2010-2703

CVE-2010-2703—

Stack-based buffer overflow in the execvp_nc function in the ov.dll module in HP OpenView Network Node Manager (OV NNM)

50RISK

open ↗

Referência

CVE-2013-6618

CVE-2013-6618—

jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,

28RISK

open ↗

Referência

CVE-2015-7251

CVE-2015-7251—

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, whic

28RISK

open ↗

Referência

CVE-2018-1756

CVE-2018-1756HIGH

IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker co

46RISK

open ↗

Referência

CVE-2021-27890

CVE-2021-27890—

SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.

28RISK

open ↗

Referência

CVE-2015-2281

CVE-2015-2281—

Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attac

28RISK

open ↗

Referência

CVE-2026-103324

CVE-2026-103324MEDIUM

Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret

33RISK

open ↗

Referência

CVE-2013-7204

CVE-2013-7204—

Cross-site request forgery (CSRF) vulnerability in set_users.cgi in Conceptronic CIPCAMPTIWL Camera 1.0 with firmware 21

28RISK

open ↗

Referência

CVE-2009-4826

CVE-2009-4826—

Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote at

23RISK

open ↗

Referência

CVE-2016-2819

CVE-2016-2819—

Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to ex

28RISK

open ↗

Referência

CVE-2018-6223

CVE-2018-6223—

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allo

28RISK

open ↗

Referência✓ VexDay Proof

Fastpublish CMS 1.9999 - config[fsBase] Remote File Inclusion

CVE-2007-6325—webappsphp

PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attacke

28RISK

open ↗

Referência✓ VexDay Proof

jetAudio 7.0.5 - '.asx' Remote Stack Overflow (PoC)

CVE-2008-0747—doswindows

Stack-based buffer overflow in COWON America jetAudio 7.0.5 and earlier allows user-assisted remote attackers to execute

23RISK

open ↗

Referência

CVE-2010-2845

CVE-2010-2845—

SQL injection vulnerability in the QuickFAQ (com_quickfaq) component 1.0.3 for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

Ol BookMarks Manager 0.7.5 - Local File Inclusion

CVE-2008-6410—webappsphp

Directory traversal vulnerability in show.php in ol'bookmarks manager 0.7.5 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência

CVE-2012-6499

CVE-2012-6499—

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

43RISK

open ↗

Referência

CVE-2015-4616

CVE-2015-4616—

Directory traversal vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.2.5 for WordPress allo

28RISK

open ↗

Referência

CVE-2016-0736

CVE-2016-0736—

In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured c

35RISK

open ↗

Referência

CVE-2021-31682

CVE-2021-31682—

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for re

43RISK

open ↗

Referência

CVE-2018-12293

CVE-2018-12293—

The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKi

28RISK

open ↗

Referência

CVE-2022-37109

CVE-2022-37109CRITICAL

patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access

60RISK

open ↗

Referência✓ VexDay Proof

Explay CMS 2.1 - Insecure Cookie Handling

CVE-2008-6411—webappsphp

Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting th

23RISK

open ↗

Referência

CVE-2018-4222

CVE-2018-4222—

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud

28RISK

open ↗

Referência

CVE-2012-1803

CVE-2012-1803—

RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Ad

50RISK

open ↗

Referência

CVE-2010-0757

CVE-2010-0757—

Unrestricted file upload vulnerability in index.php/Attach in WikyBlog 1.7.3rc2 allows remote authenticated users to exe

23RISK

open ↗

Referência

CVE-2020-15956

CVE-2020-15956—

ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer

28RISK

open ↗

Referência

CVE-2018-12293

CVE-2018-12293—

The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKi

28RISK

open ↗

Referência

CVE-2012-3814

CVE-2012-3814—

Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote

28RISK

open ↗

Referência✓ VexDay Proof

HiveMaker Professional 1.0.2 - 'cid' SQL Injection

CVE-2008-6427—webappsphp

SQL injection vulnerability in index.php in Hivemaker Professional 1.0.2 and earlier, when magic_quotes_gpc is disabled,

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.