Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2015-1328
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
50RISK
open ↗Referência
CVE-2015-1336
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access t
23RISK
open ↗Referência
CVE-2026-10257
itsourcecode Content Management System update_ss_img.php sql injection
33RISK
open ↗Referência
CVE-2026-10807
mjperpinosa stumasy change_profile_image.php unrestricted upload
33RISK
open ↗Referência
CVE-2016-8020
Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earl
28RISK
open ↗Referência✓ VexDay Proof
phpMyWebmin 1.0 - 'window.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Joshua Muheim phpMyWebmin 1.0 allow remote attackers to execute ar
23RISK
open ↗Referência✓ VexDay Proof
phpMyWebmin 1.0 - 'window.php' Remote File Inclusion
Directory traversal vulnerability in window.php, possibly used by home.php, in Joshua Muheim phpMyWebmin 1.0 allows remo
23RISK
open ↗Referência
CVE-2015-1338
kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly ga
23RISK
open ↗Referência✓ VexDay Proof
SmallNuke 2.0.4 - Pass Recovery SQL Injection
SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic_quotes_gpc is disabled, allows remot
23RISK
open ↗Referência✓ VexDay Proof
Joomla! Component JooBlog 0.1.1 - 'PostID' SQL Injection
SQL injection vulnerability in the JooBlog (com_jb2) component 0.1.1 for Joomla! allows remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2013-7409
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possib
50RISK
open ↗Referência
CVE-2015-1338
kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly ga
23RISK
open ↗Referência
CVE-2026-41948
Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access
68RISK
open ↗Referência
CVE-2026-41947
Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
48RISK
open ↗Referência
CVE-2026-41947
Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints
48RISK
open ↗Referência✓ VexDay Proof
VeryPDF PDFView - OCX ActiveX OpenPDF Heap Overflow (PoC)
Heap-based buffer overflow in the PDFVIEW.PdfviewCtrl.1 ActiveX control in pdfview.ocx 2.0.0.1 in VeryDOC PDF Viewer OCX
50RISK
open ↗Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Insecure Cookie Handling
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_
23RISK
open ↗Referência
CVE-2015-2680
Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack th
23RISK
open ↗Referência
CVE-2019-1663
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗Referência
CVE-2026-8127
eladmin Users API Endpoint UserController.java checkLevel access control
33RISK
open ↗Referência
CVE-2015-4681
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.