Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,402cataloged exploits
34,906CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,861GitHub PoC 13,907VulnCheck XDB 8,484Nuclei 4,239Metasploit 3,468✓ verified onlyrecentpopularrisk
21,797 exploits
Referência
CVE-2018-10257
CVE-2018-10257—
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗
Referência
CVE-2021-28419
CVE-2021-28419—
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads
28RISK
open ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗
Referência✓ VexDay Proof
Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions
CVE-2006-5495—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execut
23RISK
open ↗
Referência
CVE-2023-23163
CVE-2023-23163—
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parame
23RISK
open ↗
Referência✓ VexDay Proof
ID Automation Linear Barcode - ActiveX Denial of Service
CVE-2007-2658—doswindows
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows
23RISK
open ↗
Referência
CVE-2023-23162
CVE-2023-23162—
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter
23RISK
open ↗
Referência
CVE-2010-1708
CVE-2010-1708—
Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2018-6024
CVE-2018-6024—
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗
Referência
CVE-2018-6024
CVE-2018-6024—
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗
Referência
Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution)
CVE-2023-22855CRITICALremotewindows
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 808
53RISK
open ↗
Referência
CVE-2025-34043
CVE-2025-34043CRITICAL
Vacron NVR Remote Command Execution
48RISK
open ↗
Referência
CVE-2013-6343
CVE-2013-6343—
Multiple buffer overflows in web.c in httpd on the ASUS RT-N56U and RT-AC66U routers with firmware 3.0.0.4.374_979 allow
23RISK
open ↗
Referência
CVE-2017-11662
CVE-2017-11662—
The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can cause a denial of service (invalid memory read and appli
23RISK
open ↗
Referência
CVE-2020-15930
CVE-2020-15930—
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
23RISK
open ↗
Referência
CVE-2024-53584
CVE-2024-53584CRITICAL
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
48RISK
open ↗
Referência
CVE-2017-17591
CVE-2017-17591—
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗
Referência
CVE-2017-17591
CVE-2017-17591—
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
23RISK
open ↗
Referência
CVE-2014-100003
CVE-2014-100003—
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗
Referência
CVE-2014-100003
CVE-2014-100003—
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗
Referência✓ VexDay Proof
Musoo 0.21 - Remote File Inclusion
CVE-2007-3297—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code vi
23RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6495—webappsasp
inc_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permis
23RISK
open ↗
Referência
CVE-2020-8777
CVE-2020-8777—
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo,
23RISK
open ↗
Referência
CVE-2026-66751
CVE-2026-66751MEDIUM
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
33RISK
open ↗
Referência
CVE-2014-5200
CVE-2014-5200—
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2013-4098
CVE-2013-4098—
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via
23RISK
open ↗
Referência
CVE-2012-5347
CVE-2012-5347—
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter
23RISK
open ↗
Referência
CVE-2018-1002000
CVE-2018-1002000—
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require ad
23RISK
open ↗
Referência
CVE-2023-1826
CVE-2023-1826MEDIUM
SourceCodester Online Computer and Laptop Store index.php unrestricted upload
33RISK
open ↗
← previouspage 306 / 727next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.