Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,313cataloged exploits

34,834CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,797GitHub PoC 13,885VulnCheck XDB 8,484Nuclei 4,237Metasploit 3,467✓ verified onlyrecent popular risk

21,797 exploits

Referência

CVE-2015-2169

CVE-2015-2169—

Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attacker

23RISK

open ↗

Referência

CVE-2016-4230

CVE-2016-4230—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows

35RISK

open ↗

Referência✓ VexDay Proof

Oracle 10g - MDSYS.SDO_TOPO_DROP_FTBL SQL Injection (Metasploit)

CVE-2008-3979—localmultiple

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authent

50RISK

open ↗

Referência✓ VexDay Proof

Konqueror 3.5.9 - 'font color' Remote Crash

CVE-2008-4514—doslinux

The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via a fo

23RISK

open ↗

Referência

CVE-2017-3131

CVE-2017-3131—

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to exec

38RISK

open ↗

Referência

CVE-2006-4040

CVE-2006-4040—

PHP remote file inclusion vulnerability in myevent.php in myWebland myEvent 1.3 and earlier allows remote attackers to e

23RISK

open ↗

Referência

CVE-2018-10718

CVE-2018-10718—

Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2 before 2018-04-26 allows remote at

35RISK

open ↗

Referência

CVE-2012-5877

CVE-2012-5877—

Nero MediaHome 4.5.8.0 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and cr

23RISK

open ↗

Referência

CVE-2025-34513

CVE-2025-34513CRITICAL

Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Command Injection

48RISK

open ↗

Referência

CVE-2018-5333

CVE-2018-5333—

In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning

38RISK

open ↗

Referência

CVE-2012-3807

CVE-2012-3807—

Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.

35RISK

open ↗

Referência

CVE-2014-1202

CVE-2014-1202—

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a c

23RISK

open ↗

Referência

CVE-2014-1202

CVE-2014-1202—

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a c

23RISK

open ↗

Referência

CVE-2017-7115

CVE-2017-7115—

An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. The issue invo

23RISK

open ↗

Referência

CVE-2023-36355

CVE-2023-36355—

TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6Cfg

35RISK

open ↗

Referência

CVE-2018-6126

CVE-2018-6126—

A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds m

23RISK

open ↗

Referência

CVE-2019-6714

CVE-2019-6714—

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in Po

35RISK

open ↗

Referência

CVE-2013-3482

CVE-2013-3482—

Stack-based buffer overflow in the rf_report_error function in ermapper_u.dll in Intergraph ERDAS ER Viewer before 13.0.

50RISK

open ↗

Referência

CVE-2009-4656

CVE-2009-4656—

Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-as

50RISK

open ↗

Referência✓ VexDay Proof

Dokuwiki 2009-02-14 - Temporary/Remote File Inclusion

CVE-2009-1960—webappsphp

inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote att

28RISK

open ↗

Referência✓ VexDay Proof

awrate.com Message Board 1.0 - 'search.php' Remote File Inclusion

CVE-2006-6368—webappsphp

PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP

23RISK

open ↗

Referência✓ VexDay Proof

SasCam WebCam Server 2.6.5 - ActiveX Remote Buffer Overflow

CVE-2008-6898—remotewindows

Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote

50RISK

open ↗

Referência

CVE-2010-3456

CVE-2010-3456—

Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to r

23RISK

open ↗

Referência

CVE-2019-7265

CVE-2019-7265—

Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH).

28RISK

open ↗

Referência

CVE-2010-3456

CVE-2010-3456—

Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to r

23RISK

open ↗

Referência

CVE-2025-41244

CVE-2025-41244HIGHunder attack

VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)

71RISK

open ↗

Referência

CVE-2021-27519

CVE-2021-27519—

A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "

38RISK

open ↗

Referência

CVE-2016-6512

CVE-2016-6512—

epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, whi

23RISK

open ↗

Referência

CVE-2010-0373

CVE-2010-0373—

SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrar

23RISK

open ↗

Referência

CVE-2010-4769

CVE-2010-4769—

Directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read a

38RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.