Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,412cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 10,014Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
CVE-2009-2361
CVE-2009-2361—
SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2019-16223
CVE-2019-16223—
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
23RISK
open ↗
Referência
CVE-2021-25155
CVE-2021-25155—
A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v
28RISK
open ↗
Referência
CVE-2009-3709
CVE-2009-3709—
Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-a
23RISK
open ↗
Referência
CVE-2026-16627
CVE-2026-16627HIGH
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
41RISK
open ↗
Referência
CVE-2010-2153
CVE-2010-2153—
Unrestricted file upload vulnerability in admin/code/tce_functions_tcecode_editor.php in TCExam 10.1.006 and 10.1.007 al
23RISK
open ↗
Referência
CVE-2026-19052
CVE-2026-19052MEDIUM
ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls
33RISK
open ↗
Referência
CVE-2017-1000364
CVE-2017-1000364—
An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficie
38RISK
open ↗
Referência✓ VexDay Proof
MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection
CVE-2007-2211—webappsphp
SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
Carscripts Classifieds - 'cat' SQL Injection
CVE-2008-2844—webappsphp
SQL injection vulnerability in index.php in Carscripts Classifieds allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2017-13876
CVE-2017-13876—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2012-0904
CVE-2012-0904—
VLC media player 1.1.11 allows remote attackers to cause a denial of service (crash) via a long string in an amr file.
23RISK
open ↗
Referência
CVE-2014-1854
CVE-2014-1854—
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free p
23RISK
open ↗
Referência✓ VexDay Proof
phpEmployment - 'PHP Upload' Arbitrary File Upload
CVE-2008-6920—webappsphp
Unrestricted file upload vulnerability in auth.php in phpEmployment 1.8 allows remote attackers to execute arbitrary cod
23RISK
open ↗
Referência
CVE-2017-18256
CVE-2017-18256—
Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert
23RISK
open ↗
Referência
CVE-2017-8477
CVE-2017-8477—
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,
23RISK
open ↗
Referência
CVE-2018-6911
CVE-2018-6911—
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS
28RISK
open ↗
Referência
CVE-2019-1144
CVE-2019-1144HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RISK
open ↗
Referência
CVE-2021-20031
CVE-2021-20031—
A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management
43RISK
open ↗
Referência
Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
CVE-2022-36446—webappslinux
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗
Referência
CVE-2022-50794
CVE-2022-50794CRITICAL
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username
48RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Photoracer 1.0 - 'id' SQL Injection
CVE-2009-2122—webappsphp
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta
23RISK
open ↗
Referência
CVE-2010-4847
CVE-2010-4847—
SQL injection vulnerability in view_item.php in MH Products MHP Downloadshop allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2012-3153
CVE-2012-3153—
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and
60RISK
open ↗
Referência
CVE-2023-4114
CVE-2023-4114MEDIUM
PHP Jabbers Night Club Booking Software index.php cross site scripting
48RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Explorer - '.AVI' File Denial of Service
CVE-2007-0562—doswindows
Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause
28RISK
open ↗
Referência✓ VexDay Proof
Maian Recipe 1.0 - 'path_to_folder' Remote File Inclusion
CVE-2007-0848—webappsphp
PHP remote file inclusion vulnerability in classes/class_mail.inc.php in Maian Recipe 1.0 allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2010-0952
CVE-2010-0952—
SQL injection vulnerability in index.php in OneCMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2017-13713
CVE-2017-13713—
T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user
23RISK
open ↗
Referência
CVE-2012-5223
CVE-2012-5223—
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allo
50RISK
open ↗
← previouspage 198 / 869next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.