Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência
CVE-2015-6102
CVE-2015-6102—
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗
Referência
CVE-2015-7890
CVE-2015-7890—
Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung
23RISK
open ↗
Referência
CVE-2017-0059
CVE-2017-0059MEDIUMunder attack
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via
75RISK
open ↗
Referência✓ VexDay Proof
chCounter 3.1.3 - Authentication Bypass
CVE-2009-1347—webappsphp
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Zervit Web Server 0.02 - Remote Buffer Overflow (PoC)
CVE-2009-1353—doswindows
Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause
23RISK
open ↗
Referência✓ VexDay Proof
TotalCalendar 2.4 - 'Include' Local File Inclusion
CVE-2009-1406—webappsphp
Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute
23RISK
open ↗
Referência
CVE-2026-111947
CVE-2026-111947MEDIUM
Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication
33RISK
open ↗
Referência
CVE-2026-114040
CVE-2026-114040MEDIUM
DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
33RISK
open ↗
Referência
CVE-2026-113744
CVE-2026-113744CRITICAL
Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
48RISK
open ↗
Referência
CVE-2022-32429
CVE-2022-32429—
An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technolog
60RISK
open ↗
Referência
CVE-2012-1259
CVE-2012-1259—
Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and pos
23RISK
open ↗
Referência
CVE-2026-15245
CVE-2026-15245MEDIUM
BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode
33RISK
open ↗
Referência
CVE-2026-19071
CVE-2026-19071MEDIUM
itsourcecode Hospital Management System viewappointment.php sql injection
33RISK
open ↗
Referência
CVE-2026-19070
CVE-2026-19070MEDIUM
itsourcecode Hospital Management System viewadmin.php sql injection
33RISK
open ↗
Referência
CVE-2022-35411
CVE-2022-35411—
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header i
35RISK
open ↗
Referência
CVE-2026-96892
CVE-2026-96892MEDIUM
Edimax BR-6428nC goform websRedirect redirect
33RISK
open ↗
Referência
CVE-2026-82589
CVE-2026-82589MEDIUM
Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service
33RISK
open ↗
Referência
CVE-2015-6104
CVE-2015-6104—
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window
35RISK
open ↗
Referência
CVE-2022-35914
CVE-2022-35914CRITICALunder attack
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗
Referência
CVE-2015-6104
CVE-2015-6104—
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window
35RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência✓ VexDay Proof
Kusaba 1.0.4 - Remote Code Execution (1)
CVE-2008-5663—webappsphp
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execut
23RISK
open ↗
Referência
CVE-2026-84110
CVE-2026-84110MEDIUM
Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security
33RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2026-74916
CVE-2026-74916MEDIUM
WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
33RISK
open ↗
Referência
CVE-2014-6271
CVE-2014-6271CRITICALunder attack
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
Referência
CVE-2022-40684
CVE-2022-40684CRITICALunder attackransomware
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗
Referência✓ VexDay Proof
XOOPS Module Amevents - SQL Injection
CVE-2008-5768—webappsphp
SQL injection vulnerability in print.php in the AM Events (aka Amevents) module 0.22 for XOOPS allows remote attackers t
23RISK
open ↗
← previouspage 255 / 872next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.