Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2023-2796
CVE-2023-2796—
EventON < 2.1.2 - Unauthenticated Event Access
50RISK
open ↗
Referência
CVE-2026-104982
CVE-2026-104982MEDIUM
Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
33RISK
open ↗
Referência
CVE-2014-0038
CVE-2014-0038—
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
50RISK
open ↗
Referência
CVE-2015-6972
CVE-2015-6972—
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2025-34027
CVE-2025-34027CRITICAL
Versa Concerto Authentication Bypass File Write Remote Code Execution
75RISK
open ↗
Referência
CVE-2009-4840
CVE-2009-4840—
Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attac
23RISK
open ↗
Referência
CVE-2018-18865
CVE-2018-18865—
The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13
23RISK
open ↗
Referência
CVE-2026-90795
CVE-2026-90795MEDIUM
itsourcecode Loan Management System navbar.php cross site scripting
33RISK
open ↗
Referência
CVE-2010-1925
CVE-2010-1925—
SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2018-18865
CVE-2018-18865—
The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13
23RISK
open ↗
Referência
CVE-2018-4936
CVE-2018-4936—
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitat
28RISK
open ↗
Referência
CVE-2026-96962
CVE-2026-96962LOW
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code
28RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Links 1.3 - Authentication Bypass
CVE-2008-6720—webappsphp
SQL injection vulnerability in admin/adm_login.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-1930
CVE-2010-1930—
Off-by-one error in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allows remote attackers to cause a denial of service (dae
23RISK
open ↗
Referência
CVE-2010-4633
CVE-2010-4633—
SQL injection vulnerability in cart.php in digiSHOP 2.0.2 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2011-2657
CVE-2011-2657—
Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in Laun
50RISK
open ↗
Referência
CVE-2019-9767
CVE-2019-9767—
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RISK
open ↗
Referência
CVE-2019-9767
CVE-2019-9767—
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RISK
open ↗
Referência
CVE-2013-5447
CVE-2013-5447—
Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to exe
50RISK
open ↗
Referência✓ VexDay Proof
Lama Software 14.12.2007 - Multiple Remote File Inclusions
CVE-2008-0423—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code
35RISK
open ↗
Referência
CVE-2014-2927
CVE-2014-2927—
The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.4.0 before
23RISK
open ↗
Referência
CVE-2017-16930
CVE-2017-16930—
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute
35RISK
open ↗
Referência
CVE-2017-7061
CVE-2017-7061—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência
CVE-2019-11446
CVE-2019-11446—
An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user
23RISK
open ↗
Referência
CVE-2021-40352
CVE-2021-40352—
OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can re
23RISK
open ↗
Referência
OpenWrt 23.05 - Authenticated Remote Code Execution (RCE)
CVE-2026-46368HIGHlocalmultiple
luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
41RISK
open ↗
Referência
CVE-2023-1650
CVE-2023-1650CRITICAL
ChatBot < 4.4.7 - Unauthenticated PHP Object Injection
60RISK
open ↗
Referência
CVE-2011-2921
CVE-2011-2921—
ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified com
60RISK
open ↗
Referência✓ VexDay Proof
BolinOS 4.6.1 - Local File Inclusion / Cross-Site Scripting
CVE-2008-1555—webappsphp
Directory traversal vulnerability in system/_b/contentFiles/gbincluder.php in BolinOS 4.6.1 allows remote attackers to i
23RISK
open ↗
Referência✓ VexDay Proof
CMScout 2.06 - SQL Injection / Local File Inclusion
CVE-2008-6725—webappsphp
Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL command
23RISK
open ↗
← previouspage 186 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.