Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência✓ VexDay Proof
phpBB++ Build 100 - 'phpbb_root_path' Remote File Inclusion
CVE-2007-0762—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in phpBB++ Build 100 allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2012-2575
CVE-2012-2575—
Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2026-90507
CVE-2026-90507MEDIUM
vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control
33RISK
open ↗
Referência
CVE-2026-75086
CVE-2026-75086MEDIUM
itsourcecode Hospital Management System viewroom.php sql injection
33RISK
open ↗
Referência
CVE-2020-8899
CVE-2020-8899CRITICAL
Memory corruption in Quram library when decoding qmg can lead to RCE
48RISK
open ↗
Referência✓ VexDay Proof
e107 Plugin My_Gallery 2.3 - Arbitrary File Download
CVE-2008-1702—webappsphp
Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obta
23RISK
open ↗
Referência
CVE-2018-4193
CVE-2018-4193—
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Windows Ser
23RISK
open ↗
Referência
CVE-2023-53941
CVE-2023-53941CRITICAL
EasyPHP Webserver 14.1 Remote Code Execution
48RISK
open ↗
Referência
CVE-2025-14708
CVE-2025-14708CRITICAL
Shiguangwu sgwbox N3 WIREDCFGGET http_eshell_server buffer overflow
48RISK
open ↗
Referência
CVE-2020-12352
CVE-2020-12352—
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adja
23RISK
open ↗
Referência
CVE-2020-12352
CVE-2020-12352—
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adja
23RISK
open ↗
Referência
CVE-2021-24750
CVE-2021-24750—
WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection
50RISK
open ↗
Referência
CVE-2017-2371
CVE-2017-2371—
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" compon
23RISK
open ↗
Referência
CVE-2023-33131
CVE-2023-33131HIGH
Microsoft Outlook Remote Code Execution Vulnerability
41RISK
open ↗
Referência
CVE-2026-84253
CVE-2026-84253CRITICAL
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
48RISK
open ↗
Referência
CVE-2011-0502
CVE-2011-0502—
Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attack
23RISK
open ↗
Referência
CVE-2017-8869
CVE-2017-8869—
Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.
43RISK
open ↗
Referência
CVE-2012-2576
CVE-2012-2576—
SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Prof
50RISK
open ↗
Referência
CVE-2018-12292
CVE-2018-12292—
A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3.
23RISK
open ↗
Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (PoC)
CVE-2009-0174—doswindows
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RISK
open ↗
Referência
CVE-2010-0456
CVE-2010-0456—
SQL injection vulnerability in the indianpulse Game Server (com_gameserver) component 1.2 for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2023-4278
CVE-2023-4278HIGH
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
41RISK
open ↗
Referência
CVE-2007-6478
CVE-2007-6478—
Stack-based buffer overflow in Rosoft Media Player 4.1.7, 4.1.8, and possibly earlier versions allows remote attackers t
23RISK
open ↗
Referência
CVE-2015-3673
CVE-2015-3673—
Admin Framework in Apple OS X before 10.10.4 does not properly restrict the location of writeconfig clients, which allow
38RISK
open ↗
Referência
CVE-2016-4997
CVE-2016-4997—
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux
38RISK
open ↗
Referência
CVE-2016-4997
CVE-2016-4997—
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux
38RISK
open ↗
Referência
CVE-2019-8924
CVE-2019-8924—
XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.
23RISK
open ↗
Referência✓ VexDay Proof
AS-GasTracker 1.0.0 - Insecure Cookie Handling
CVE-2008-2269—webappsphp
AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote attackers to bypass authentication and gain privileges by set
23RISK
open ↗
Referência
CVE-2010-2920
CVE-2010-2920—
Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allow
38RISK
open ↗
Referência
CVE-2019-8924
CVE-2019-8924—
XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.
23RISK
open ↗
← previouspage 184 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.