Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,150 exploits
Referência
CVE-2009-4906
Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the
23RISK
open ↗Referência
CVE-2009-4906
Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the
23RISK
open ↗Referência
CVE-2015-2789
Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.
23RISK
open ↗Referência
CVE-2014-9605
WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass aut
23RISK
open ↗Referência
CVE-2015-2508
The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application,
23RISK
open ↗Referência✓ VexDay Proof
wget 1.10.2 - Unchecked Boundary Condition Denial of Service
The ftp_syst function in ftp-basic.c in Free Software Foundation (FSF) GNU wget 1.10.2 allows remote attackers to cause
23RISK
open ↗Referência
CVE-2026-97895
krayin laravel-crm User Management UserController.php privileges management
33RISK
open ↗Referência✓ VexDay Proof
exV2 < 2.0.4.3 - 'extract()' Remote Command Execution
Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite
28RISK
open ↗Referência
CVE-2023-34634
Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .green
38RISK
open ↗Referência✓ VexDay Proof
IP Reg 0.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vl
23RISK
open ↗Referência
CVE-2009-4093
Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remo
23RISK
open ↗Referência✓ VexDay Proof
k-links directory - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Qsoft K-Links allows remote attackers to inject arbitrary web s
23RISK
open ↗Referência
CVE-2010-4989
SQL injection vulnerability in main.asp in Ziggurat Farsi CMS allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2011-4714
Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files v
23RISK
open ↗Referência
CVE-2008-3723
Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to
23RISK
open ↗Referência
CVE-2012-4891
Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers t
23RISK
open ↗Referência
CVE-2015-2680
Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack th
23RISK
open ↗Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array paramet
23RISK
open ↗Referência
CVE-2026-97064
X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
48RISK
open ↗Referência
CVE-2009-3709
Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-a
23RISK
open ↗Referência
CVE-2016-8655
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗Referência
CVE-2018-17428
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio par
23RISK
open ↗Referência
CVE-2019-11416
A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstr
23RISK
open ↗Referência
CVE-2023-36266
An issue was discovered in Keeper Password Manager for Desktop version 16.10.2 (fixed in 17.2), and the KeeperFill Brows
23RISK
open ↗Referência
CVE-2005-4696
The Microsoft Wireless Zero Configuration system (WZCS) stores WEP keys and pair-wise Master Keys (PMK) of the WPA pre-s
23RISK
open ↗Referência
CVE-2016-8655
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗Referência
CVE-2006-1747
PHP remote file inclusion vulnerability in Virtual War (VWar) 1.5.0 allows remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência
CVE-2013-4950
Cross-site scripting (XSS) vulnerability in view.php in Machform 2 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗Referência
CVE-2011-5228
Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote att
23RISK
open ↗Referência
CVE-2017-8479
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.