Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,542cataloged exploits
34,971CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,947VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,468✓ verified onlyrecentpopularrisk
21,797 exploits
Referência
CVE-2012-2276
CVE-2012-2276—
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote
23RISK
open ↗
Referência
CVE-2017-18195
CVE-2017-18195—
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enum
28RISK
open ↗
Referência
CVE-2009-3975
CVE-2009-3975—
SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2013-6793
CVE-2013-6793—
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote a
23RISK
open ↗
Referência
CVE-2015-4667
CVE-2015-4667—
Multiple hardcoded credentials in Xsuite 2.x.
28RISK
open ↗
Referência
CVE-2017-13869
CVE-2017-13869—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2026-16060
CVE-2026-16060CRITICAL
Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2018-10504
CVE-2018-10504—
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
23RISK
open ↗
Referência
CVE-2021-43140
CVE-2021-43140—
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
23RISK
open ↗
Referência
CVE-2015-4010
CVE-2015-4010—
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows rem
23RISK
open ↗
Referência
Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
CVE-2020-15261HIGHlocalwindows
Unquoted service path vulnerability on Veyon
46RISK
open ↗
Referência
CVE-2010-2314
CVE-2010-2314—
PHP remote file inclusion vulnerability in nucleus/plugins/NP_Twitter.php in the NP_Twitter Plugin 0.8 and 0.9 for Nucle
23RISK
open ↗
Referência
CVE-2010-2314
CVE-2010-2314—
PHP remote file inclusion vulnerability in nucleus/plugins/NP_Twitter.php in the NP_Twitter Plugin 0.8 and 0.9 for Nucle
23RISK
open ↗
Referência
CVE-2010-1305
CVE-2010-1305—
Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot
43RISK
open ↗
Referência
CVE-2017-2515
CVE-2017-2515—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2011-2544
CVE-2011-2544—
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier a
23RISK
open ↗
Referência
CVE-2017-6371
CVE-2017-6371—
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string
23RISK
open ↗
Referência
CVE-2017-6371
CVE-2017-6371—
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string
23RISK
open ↗
Referência
CVE-2026-12965
CVE-2026-12965CRITICAL
Super Store Finder <= 7.8 - Unauthenticated SQL Injection via ssf_tracking
48RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2015-8356
CVE-2015-8356—
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u
23RISK
open ↗
Referência
CVE-2023-0963
CVE-2023-0963HIGH
SourceCodester Music Gallery Site POST Request Users.php access control
41RISK
open ↗
Referência
CVE-2011-0887
CVE-2011-0887—
The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses pred
23RISK
open ↗
Referência
CVE-2014-1843
CVE-2014-1843—
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISK
open ↗
Referência✓ VexDay Proof
Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite
CVE-2007-2644—remotewindows
A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrar
23RISK
open ↗
Referência
CVE-2017-6999
CVE-2017-6999—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência
CVE-2017-6997
CVE-2017-6997—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
← previouspage 313 / 727next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.