Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,662 exploits
Referência
CVE-2010-1701
CVE-2010-1701—
SQL injection vulnerability in browse.html in PHP Video Battle Script allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
SFS Ez Forum - SQL Injection
CVE-2008-4754—webappsphp
SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2015-9222
CVE-2015-9222—
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W,
23RISK
open ↗
Referência
CVE-2012-4988
CVE-2012-4988—
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99
23RISK
open ↗
Referência
CVE-2018-4139
CVE-2018-4139—
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "kext tools"
23RISK
open ↗
Referência
CVE-2018-19782
CVE-2018-19782—
Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2018-19782
CVE-2018-19782—
Multiple cross-site scripting (XSS) vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject
23RISK
open ↗
Referência
CVE-2020-10385
CVE-2020-10385—
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.
23RISK
open ↗
Referência
CVE-2022-4328
CVE-2022-4328CRITICAL
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Referência
CVE-2009-4867
CVE-2009-4867—
Buffer overflow in Tuniac 090517c allows remote attackers to cause a denial of service (application crash) or possibly e
23RISK
open ↗
Referência
CVE-2017-13875
CVE-2017-13875—
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Intel Graph
23RISK
open ↗
Referência✓ VexDay Proof
Ext 1.0 - 'feed-proxy.php?feed' Remote File Disclosure
CVE-2007-2285—webappsphp
Directory traversal vulnerability in examples/layout/feed-proxy.php in Jack Slocum Ext 1.0 alpha1 (Ext JS) allows remote
28RISK
open ↗
Referência✓ VexDay Proof
SyndeoCMS 2.5.01 - 'cmsdir' Remote File Inclusion
CVE-2007-5840—webappsphp
PHP remote file inclusion vulnerability in starnet/themes/c-sky/main.inc.php in Fred Stuurman SyndeoCMS 2.5.01 allows re
23RISK
open ↗
Referência
CVE-2019-9593
CVE-2019-9593—
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Nokia e90/n82 (s60v3) - Remote Denial of Service
CVE-2008-4135—doshardware
Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause
23RISK
open ↗
Referência✓ VexDay Proof
K&S Shopsysteme - Arbitrary File Upload
CVE-2008-6768—webappsphp
Unrestricted file upload vulnerability in admin/editor/images.php in K&S Shopsoftware allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2019-9593
CVE-2019-9593—
A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-2334
CVE-2010-2334—
Directory traversal vulnerability in themes/default/download.php in Yamamah Photo Gallery 1.00, as distributed before 20
23RISK
open ↗
Referência
CVE-2009-4596
CVE-2009-4596—
Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2025-34095
CVE-2025-34095CRITICAL
Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp
63RISK
open ↗
Referência
CVE-2025-34095
CVE-2025-34095CRITICAL
Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp
63RISK
open ↗
Referência
CVE-2010-1702
CVE-2010-1702—
SQL injection vulnerability in submitticket.php in WHMCompleteSolution (WHMCS) 4.2 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2015-2370
CVE-2015-2370—
The authentication implementation in the RPC subsystem in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP
23RISK
open ↗
Referência
CVE-2010-1702
CVE-2010-1702—
SQL injection vulnerability in submitticket.php in WHMCompleteSolution (WHMCS) 4.2 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2013-1804
CVE-2013-1804—
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2015-1060
CVE-2015-1060—
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect
23RISK
open ↗
Referência
CVE-2015-1060
CVE-2015-1060—
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect
23RISK
open ↗
Referência
CVE-2013-3661
CVE-2013-3661—
The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vist
23RISK
open ↗
Referência
CVE-2012-4771
CVE-2012-4771—
Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2016-1861
CVE-2016-1861—
The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privi
23RISK
open ↗
← previouspage 259 / 723next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.