Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2014-8493
CVE-2014-8493—
ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted reque
23RISK
open ↗
Referência
CVE-2017-1000367
CVE-2017-1000367—
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_
23RISK
open ↗
Referência
CVE-2026-94275
CVE-2026-94275MEDIUM
Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter
33RISK
open ↗
Referência
CVE-2022-0848
CVE-2022-0848CRITICAL
OS Command Injection in part-db/part-db
60RISK
open ↗
Referência✓ VexDay Proof
Pre ADS Portal 2.0 - Authentication Bypass / Cross-Site Scripting
CVE-2008-6715—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in Pre ADS Portal 2.0 and earlier allow remote attackers to inject a
23RISK
open ↗
Referência
CVE-2009-3185
CVE-2009-3185—
SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to
23RISK
open ↗
Referência
CVE-2019-8404
CVE-2019-8404—
An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted
23RISK
open ↗
Referência
CVE-2019-8404
CVE-2019-8404—
An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted
23RISK
open ↗
Referência✓ VexDay Proof
PHPBB2 MODificat 0.2.0 - 'functions.php' Remote File Inclusion
CVE-2007-0656—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote at
28RISK
open ↗
Referência✓ VexDay Proof
TOSMO/Mambo 1.4.13a - 'absolute_path' Remote File Inclusion
CVE-2007-2317—webappsphp
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and p
23RISK
open ↗
Referência✓ VexDay Proof
FirmWorX 0.1.2 - Multiple Remote File Inclusions
CVE-2007-2891—webappsphp
Multiple PHP remote file inclusion vulnerabilities in FirmWorX 0.1.2 allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗
Referência
CVE-2015-6972
CVE-2015-6972—
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component rekry 1.0.0 - 'op_id' SQL Injection
CVE-2008-1535—webappsphp
SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allow
23RISK
open ↗
Referência
CVE-2017-11282
CVE-2017-11282—
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation co
35RISK
open ↗
Referência
CVE-2014-0038
CVE-2014-0038—
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
50RISK
open ↗
Referência
CVE-2017-5869
CVE-2017-5869—
Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote auth
35RISK
open ↗
Referência
CVE-2023-2796
CVE-2023-2796—
EventON < 2.1.2 - Unauthenticated Event Access
50RISK
open ↗
Referência
CVE-2026-104982
CVE-2026-104982MEDIUM
Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal
33RISK
open ↗
Referência
CVE-2014-0038
CVE-2014-0038—
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
50RISK
open ↗
Referência
CVE-2015-6972
CVE-2015-6972—
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2025-34027
CVE-2025-34027CRITICAL
Versa Concerto Authentication Bypass File Write Remote Code Execution
75RISK
open ↗
Referência
CVE-2009-4840
CVE-2009-4840—
Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attac
23RISK
open ↗
Referência
CVE-2018-18865
CVE-2018-18865—
The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13
23RISK
open ↗
Referência
CVE-2026-90795
CVE-2026-90795MEDIUM
itsourcecode Loan Management System navbar.php cross site scripting
33RISK
open ↗
Referência
CVE-2010-1925
CVE-2010-1925—
SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2018-18865
CVE-2018-18865—
The Royal browser extensions TS before 4.3.60728 (Release Date 2018-07-28) and TSX before 3.3.1 (Release Date 2018-09-13
23RISK
open ↗
Referência
CVE-2018-4936
CVE-2018-4936—
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitat
28RISK
open ↗
Referência
CVE-2026-96962
CVE-2026-96962LOW
Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code
28RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Links 1.3 - Authentication Bypass
CVE-2008-6720—webappsphp
SQL injection vulnerability in admin/adm_login.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-1930
CVE-2010-1930—
Off-by-one error in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allows remote attackers to cause a denial of service (dae
23RISK
open ↗
← previouspage 188 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.