Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência
CVE-2019-19363
An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attacker
38RISK
open ↗Referência
CVE-2010-4843
SQL injection vulnerability in website-page.php in PHP Web Scripts Ad Manager Pro 3.0 allows remote attackers to execute
23RISK
open ↗Referência
CVE-2010-4853
SQL injection vulnerability in the ccInvoices (com_ccinvoices) component for Joomla! allows remote attackers to execute
23RISK
open ↗Referência
CVE-2012-6303
Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in
28RISK
open ↗Referência✓ VexDay Proof
MySQL Commander 2.7 - 'home' Remote File Inclusion
PHP remote file inclusion vulnerability in ressourcen/dbopen.php in bitesser MySQL Commander 2.7 and earlier, when regis
23RISK
open ↗Referência✓ VexDay Proof
Berylium2 2003-08-18 - 'beryliumroot' Remote File Inclusion
PHP remote file inclusion vulnerability in berylium-classes.php in Berylium2 2003-08-18 allows remote attackers to execu
23RISK
open ↗Referência
CVE-2018-0749
The Microsoft Server Message Block (SMB) Server in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2
23RISK
open ↗Referência✓ VexDay Proof
WikkiTikkiTavi 1.11 - Arbitrary '.PHP' File Upload
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2020-8819
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in
23RISK
open ↗Referência
CVE-2009-4059
SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2021-42697
Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, whic
35RISK
open ↗Referência
CVE-2023-24217
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
41RISK
open ↗Referência
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
23RISK
open ↗Referência
CVE-2026-77784
Rank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as
28RISK
open ↗Referência
CVE-2010-1980
Directory traversal vulnerability in joomlaflickr.php in the Joomla Flickr (com_joomlaflickr) component 1.0.3 for Joomla
43RISK
open ↗Referência
CVE-2010-1981
Directory traversal vulnerability in the Fabrik (com_fabrik) component 2.0 for Joomla! allows remote attackers to read a
43RISK
open ↗Referência
CVE-2012-6505
Cross-site scripting (XSS) vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remot
23RISK
open ↗Referência✓ VexDay Proof
TR Forum 2.0 - SQL Injection / Bypass Security Restriction
Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and passwo
23RISK
open ↗Referência
CVE-2000-1196
PSCOErrPage.htm in Netscape PublishingXpert 2.5 before SP2 allows remote attackers to read arbitrary files by specifying
23RISK
open ↗Referência✓ VexDay Proof
wbblog - Cross-Site Scripting / SQL Injection
Cross-site scripting (XSS) vulnerability in index.php in WBBlog allows remote attackers to inject arbitrary web script o
23RISK
open ↗Referência
CVE-2015-2789
Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.
23RISK
open ↗Referência
CVE-2024-10811
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
48RISK
open ↗Referência
CVE-2018-13989
Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.