Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
26,041 exploits
Referência
CVE-2016-7098
CVE-2016-7098—
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow
23RISK
open ↗
Referência
CVE-2017-7037
CVE-2017-7037—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência
CVE-2014-5370
CVE-2014-5370—
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra
23RISK
open ↗
Referência
CVE-2014-5370
CVE-2014-5370—
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra
23RISK
open ↗
Referência
CVE-2014-8949
CVE-2014-8949—
The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitr
23RISK
open ↗
Referência
CVE-2015-5074
CVE-2015-5074—
Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php
23RISK
open ↗
Referência
CVE-2019-6279
CVE-2019-6279—
ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnera
23RISK
open ↗
Referência
CVE-2021-41773
CVE-2021-41773HIGHunder attackransomware
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
Referência
CVE-2026-112087
CVE-2026-112087MEDIUM
itsourcecode Online Cake Ordering System confirm.php sql injection
33RISK
open ↗
Referência
CVE-2026-9271
CVE-2026-9271MEDIUM
KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS
33RISK
open ↗
Referência✓ VexDay Proof
eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
CVE-2006-6871—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2014-9262
CVE-2014-9262—
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.
23RISK
open ↗
Referência
CVE-2025-2620
CVE-2025-2620CRITICAL
D-Link DAP-1620 Authentication storage mod_graph_auth_uri_handler stack-based overflow
48RISK
open ↗
Referência
CVE-2015-2790
CVE-2015-2790—
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 allow remote attackers to cause a denial of service (memory c
28RISK
open ↗
Referência
CVE-2009-3315
CVE-2009-3315—
SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attacke
23RISK
open ↗
Referência
CVE-2017-9936
CVE-2017-9936—
In LibTIFF 4.0.8, there is a memory leak in tif_jbig.c. A crafted TIFF document can lead to a memory leak resulting in a
23RISK
open ↗
Referência
CVE-2018-20735
CVE-2018-20735—
An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for l
38RISK
open ↗
Referência
CVE-2020-5844
CVE-2020-5844—
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators t
35RISK
open ↗
Referência
CVE-2008-5753
CVE-2008-5753—
Stack-based buffer overflow in BulletProof FTP Client 2.63 and 2010 allows user-assisted attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2010-1951
CVE-2010-1951—
Multiple directory traversal vulnerabilities in 60cycleCMS allow remote attackers to include and execute arbitrary local
23RISK
open ↗
Referência
Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions
CVE-2023-31468HIGHlocalwindows
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\I
41RISK
open ↗
Referência
CVE-2010-2124
CVE-2010-2124—
SQL injection vulnerability in firma.php in Bartels Schone ConPresso 4.0.7 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-106014
CVE-2026-106014MEDIUM
Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
33RISK
open ↗
Referência
CVE-2026-89286
CVE-2026-89286MEDIUM
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
33RISK
open ↗
Referência
CVE-2026-13524
CVE-2026-13524MEDIUM
CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization
33RISK
open ↗
Referência
CVE-2026-13485
CVE-2026-13485MEDIUM
SourceCodester Class and Exam Timetabling System preview.php sql injection
33RISK
open ↗
Referência
CVE-2026-58049
CVE-2026-58049HIGH
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
41RISK
open ↗
Referência✓ VexDay Proof
Telekorn Signkorn Guestbook 1.3 - 'dir_path' Remote File Inclusion
CVE-2006-4788—webappsphp
PHP remote file inclusion vulnerability in includes/log.inc.php in Telekorn SignKorn Guestbook (SL) 1.3 and earlier, whe
23RISK
open ↗
Referência✓ VexDay Proof
Vz (Adp) Forum 2.0.3 - Remote Password Disclosure
CVE-2006-6891—webappsphp
Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗
Referência
CVE-2010-4839
CVE-2010-4839—
SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to e
23RISK
open ↗
← previouspage 177 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.