Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2026-110775
CVE-2026-110775HIGH
Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
41RISK
open ↗
Referência
CVE-2021-22204
CVE-2021-22204MEDIUMunder attack
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗
Referência
CVE-2026-85513
CVE-2026-85513MEDIUM
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
33RISK
open ↗
Referência✓ VexDay Proof
IMGallery 2.5 - Create Uploader Script
CVE-2007-0082—webappsphp
users_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows
23RISK
open ↗
Referência
CVE-2020-11457
CVE-2020-11457—
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full n
23RISK
open ↗
Referência
CVE-2012-6509
CVE-2012-6509—
Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP c
23RISK
open ↗
Referência✓ VexDay Proof
SkaLinks 1.5 - 'register.php' Arbitrary Add Editor
CVE-2008-7010—webappsphp
Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers to add new administrators and gain privileges via a
23RISK
open ↗
Referência
CVE-2023-2437
CVE-2023-2437CRITICAL
UserPro <= 5.1.1 - Authentication Bypass to Administrator
63RISK
open ↗
Referência
CVE-2015-1389
CVE-2015-1389—
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote at
23RISK
open ↗
Referência
CVE-2010-4985
CVE-2010-4985—
Cross-site scripting (XSS) vulnerability in notes.php in My Kazaam Notes Management System allows remote attackers to in
23RISK
open ↗
Referência
CVE-2017-0119
CVE-2017-0119—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers
28RISK
open ↗
Referência
CVE-2018-8718
CVE-2018-8718—
Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated
23RISK
open ↗
Referência
CVE-2017-15639
CVE-2017-15639—
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the
23RISK
open ↗
Referência
CVE-2018-10653
CVE-2018-10653—
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 befor
23RISK
open ↗
Referência
CVE-2009-2557
CVE-2009-2557—
Directory traversal vulnerability in system/download.php in Admin News Tools 2.5 allows remote attackers to read arbitra
23RISK
open ↗
Referência
CVE-2010-2919
CVE-2010-2919—
SQL injection vulnerability in the StaticXT (com_staticxt) component for Joomla! allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2010-2919
CVE-2010-2919—
SQL injection vulnerability in the StaticXT (com_staticxt) component for Joomla! allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2013-6234
CVE-2013-6234—
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users
23RISK
open ↗
Referência
CVE-2011-5039
CVE-2011-5039—
Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2015-1560
CVE-2015-1560—
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis
23RISK
open ↗
Referência
CVE-2021-4436
CVE-2021-4436CRITICAL
3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Referência
CVE-2017-6191
CVE-2017-6191—
Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.
23RISK
open ↗
Referência
CVE-2023-39362
CVE-2023-39362HIGH
Authenticated command injection in SNMP options of a Device
63RISK
open ↗
Referência
CVE-2009-2258
CVE-2009-2258—
Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmwar
23RISK
open ↗
Referência✓ VexDay Proof
WebMod 0.48 - Content-Length Remote Buffer Overflow
CVE-2007-1260—remotewindows
Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2010-3124
CVE-2010-3124—
Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possib
28RISK
open ↗
Referência
CVE-2010-4992
CVE-2010-4992—
SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2011-5043
CVE-2011-5043—
TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long strin
23RISK
open ↗
Referência
CVE-2011-5046
CVE-2011-5046—
The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Window
35RISK
open ↗
Referência✓ VexDay Proof
PHPLojaFacil 0.1.5 - 'path_local' Remote File Inclusion
CVE-2007-2615—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Crie seu PHPLojaFacil 0.1.5 allow remote attackers to execute arbi
23RISK
open ↗
← previouspage 192 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.