Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,190 exploits
Referência
CVE-2026-8275
bettercap zerogod IPP Service zerogod_ipp_primitives.go ippReadChunkedBody integer coercion
33RISK
open ↗Referência✓ VexDay Proof
Joomla! Component NeoRecruit 1.4 - 'id' SQL Injection
SQL injection vulnerability in index.php in the NeoRecruit component (com_neorecruit) 1.4 and earlier for Joomla! allows
23RISK
open ↗Referência
CVE-2017-17873
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
23RISK
open ↗Referência
CVE-2014-8347
An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 a
23RISK
open ↗Referência
CVE-2012-2585
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to injec
23RISK
open ↗Referência
RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)
MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting
33RISK
open ↗Referência
CVE-2015-6810
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB,
23RISK
open ↗Referência★ 302
Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x.
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
71RISK
open ↗Referência
CVE-2017-1000408
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environme
23RISK
open ↗Referência
CVE-2017-17875
The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
23RISK
open ↗Referência
CVE-2010-2460
SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers
23RISK
open ↗Referência
CVE-2011-5185
Cross-site scripting (XSS) vulnerability in video_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows re
23RISK
open ↗Referência
CVE-2026-8260
D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow
41RISK
open ↗Referência
CVE-2014-8347
An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 a
23RISK
open ↗Referência
CVE-2026-108660
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
33RISK
open ↗Referência
CVE-2012-6626
SQL injection vulnerability in verify-user.php in b2ePMS 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Referência
CVE-2014-100020
SQL injection vulnerability in ChangeEmail.php in iTechClassifieds 3.03.057 allows remote attackers to execute arbitrary
23RISK
open ↗Referência
CVE-2026-108622
JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint
33RISK
open ↗Referência✓ VexDay Proof
STPHPLibrary - 'STPHPLIB_DIR' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers
23RISK
open ↗Referência
CVE-2014-2540
SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before 1.1.1 allows remote attackers to execute arbitra
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.