Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits
40,258CVEs with public exploitation
24,696lab-tested
AllReferência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,095 exploits
Referência
Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
CVE-2020-15261HIGHlocalwindows
Unquoted service path vulnerability on Veyon
46RISK
open ↗
Referência
CVE-2026-15476
CVE-2026-15476MEDIUM
QILING Disk Master Kernel Driver diskbckp.sys access control
33RISK
open ↗
Referência
CVE-2021-43140
CVE-2021-43140—
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
23RISK
open ↗
Referência✓ VexDay Proof
FlashBB 1.1.8 - 'sendmsg.php' Remote File Inclusion
CVE-2007-3697—webappsphp
PHP remote file inclusion vulnerability in phpbb/sendmsg.php in FlashBB 1.1.8 and earlier allows remote attackers to exe
28RISK
open ↗
Referência
CVE-2011-0887
CVE-2011-0887—
The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses pred
23RISK
open ↗
Referência
CVE-2014-1843
CVE-2014-1843—
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISK
open ↗
Referência
CVE-2015-8356
CVE-2015-8356—
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u
23RISK
open ↗
Referência
CVE-2010-4979
CVE-2010-4979—
SQL injection vulnerability in image/view.php in CANDID allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência
CVE-2011-2544
CVE-2011-2544—
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier a
23RISK
open ↗
Referência
CVE-2026-14748
CVE-2026-14748MEDIUM
AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery
33RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2017-2515
CVE-2017-2515—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência
CVE-2026-90681
CVE-2026-90681MEDIUM
Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds
33RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0672—webappsphp
SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated
23RISK
open ↗
Referência
CVE-2010-2314
CVE-2010-2314—
PHP remote file inclusion vulnerability in nucleus/plugins/NP_Twitter.php in the NP_Twitter Plugin 0.8 and 0.9 for Nucle
23RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2012-5335
CVE-2012-5335—
Directory traversal vulnerability in Tiny Server 1.1.5 allows remote authenticated users to read arbitrary files via a .
23RISK
open ↗
Referência✓ VexDay Proof
A-shop 0.70 - Remote File Deletion
CVE-2007-3937—webappsasp
Multiple SQL injection vulnerabilities in A-shop 0.70 and earlier allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2013-3075
CVE-2013-3075—
Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities
28RISK
open ↗
Referência
CVE-2017-11661
CVE-2017-11661—
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory
28RISK
open ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Referência
CVE-2026-3485
CVE-2026-3485CRITICAL
D-Link DIR-868L SSDP Service sub_1BF84 os command injection
48RISK
open ↗
Referência
CVE-2019-10846
CVE-2019-10846—
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and passw
23RISK
open ↗
Referência
CVE-2010-4143
CVE-2010-4143—
SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2019-12962
CVE-2019-12962—
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
38RISK
open ↗
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2019-1674
CVE-2019-1674HIGH
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability
41RISK
open ↗
← previouspage 212 / 870next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.