Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,328cataloged exploits
40,208CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,716VulnCheck XDB 9,976Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2017-15662
CVE-2017-15662—
In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The atta
23RISK
open ↗
Referência
CVE-2010-0694
CVE-2010-0694—
SQL injection vulnerability in the PerchaGallery (com_perchagallery) component before 1.5b for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2017-3622
CVE-2017-3622—
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Common Desktop Environment (C
38RISK
open ↗
Referência
CVE-2018-10969
CVE-2018-10969—
SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2010-4280
CVE-2010-4280—
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary
23RISK
open ↗
Referência
CVE-2023-30350
CVE-2023-30350HIGH
FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin
41RISK
open ↗
Referência✓ VexDay Proof
CDex 1.70b2 (Windows XP SP3) - '.ogg' Local Buffer Overflow
CVE-2009-1039—localwindows
Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vor
23RISK
open ↗
Referência
CVE-2026-89190
CVE-2026-89190MEDIUM
Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax
33RISK
open ↗
Referência
CVE-2026-88797
CVE-2026-88797HIGH
Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation
41RISK
open ↗
Referência
CVE-2020-12501
CVE-2020-12501CRITICAL
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
48RISK
open ↗
Referência
CVE-2020-12501
CVE-2020-12501CRITICAL
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
48RISK
open ↗
Referência
CVE-2012-1198
CVE-2012-1198—
base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by
23RISK
open ↗
Referência
CVE-2018-16083
CVE-2018-16083—
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote
23RISK
open ↗
Referência
CVE-2016-1767
CVE-2016-1767—
QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (m
23RISK
open ↗
Referência
CVE-2017-13797
CVE-2017-13797—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2026-96764
CVE-2026-96764MEDIUM
kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources
33RISK
open ↗
Referência✓ VexDay Proof
Snircd 1.3.4 - 'send_user_mode' Denial of Service
CVE-2008-1501—dosmultiple
The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and u
23RISK
open ↗
Referência
CVE-2026-77939
CVE-2026-77939HIGH
Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint
41RISK
open ↗
Referência
CVE-2010-4791
CVE-2010-4791—
SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user
23RISK
open ↗
Referência
CVE-2009-4581
CVE-2009-4581—
Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magic_quotes_gpc is dis
23RISK
open ↗
Referência
CVE-2010-0701
CVE-2010-0701—
SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2026-78394
CVE-2026-78394MEDIUM
Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter
33RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component EasyBook 1.1 - 'gbid' SQL Injection
CVE-2008-2569—webappsphp
SQL injection vulnerability in the EasyBook (com_easybook) component 1.1 for Joomla! allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2026-18612
CVE-2026-18612CRITICAL
GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection
48RISK
open ↗
Referência
CVE-2017-14507
CVE-2017-14507—
Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to exec
23RISK
open ↗
Referência
CVE-2010-1877
CVE-2010-1877—
SQL injection vulnerability in the JTM Reseller (com_jtm) component 1.9 Beta for Joomla! allows remote attackers to exec
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer 7 - Clickjacking
CVE-2009-0369—remotewindows
Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick acti
28RISK
open ↗
Referência
CVE-2009-3659
CVE-2009-3659—
SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência✓ VexDay Proof
Htaccess Passwort Generator 1.1 - 'ht_pfad' Remote File Inclusion
CVE-2007-1013—webappsphp
PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote a
23RISK
open ↗
Referência
CVE-2010-0702
CVE-2010-0702—
SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to e
23RISK
open ↗
← previouspage 179 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.