Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,542cataloged exploits
34,971CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,947VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,468✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2018-4218
CVE-2018-4218—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2015-1057
CVE-2015-1057—
Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary w
23RISK
open ↗
Referência
CVE-2026-67608
CVE-2026-67608HIGH
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
41RISK
open ↗
Referência
CVE-2016-1819
CVE-2016-1819—
Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 1
23RISK
open ↗
Referência
CVE-2016-1819
CVE-2016-1819—
Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 1
23RISK
open ↗
Referência
CVE-2014-1842
CVE-2014-1842—
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISK
open ↗
Referência✓ VexDay Proof
BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflows (PoC)
CVE-2007-4816—doswindows
Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown imp
23RISK
open ↗
Referência
CVE-2013-7187
CVE-2013-7187—
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers
23RISK
open ↗
Referência
CVE-2013-7187
CVE-2013-7187—
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers
23RISK
open ↗
Referência
BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
CVE-2020-14945—webappsmultiple
A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an auth
28RISK
open ↗
Referência✓ VexDay Proof
dBpowerAMP Audio Player 2 - '.m3u' Remote Buffer Overflow
CVE-2008-0661—remotewindows
Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file w
23RISK
open ↗
Referência✓ VexDay Proof
CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
CVE-2008-2267—webappsphp
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and e
23RISK
open ↗
Referência✓ VexDay Proof
Yerba SACphp 6.3 - Local File Inclusion
CVE-2008-4486—webappsphp
Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
mxCamArchive 2.2 - Bypass Configuration Download
CVE-2008-6956—webappsphp
Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to
23RISK
open ↗
Referência
CVE-2010-4821
CVE-2010-4821—
Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2010-1947
CVE-2010-1947—
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗
Referência
CVE-2010-1947
CVE-2010-1947—
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗
Referência
CVE-2014-9175
CVE-2014-9175—
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Referência
CVE-2014-9175
CVE-2014-9175—
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Referência
CVE-2012-1002
CVE-2012-1002—
SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2015-2216
CVE-2015-2216—
SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2015-2090
CVE-2015-2090—
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISK
open ↗
Referência
CVE-2015-2090
CVE-2015-2090—
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISK
open ↗
Referência
CVE-2014-10013
CVE-2014-10013—
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to
23RISK
open ↗
Referência
CVE-2012-2276
CVE-2012-2276—
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote
23RISK
open ↗
Referência
CVE-2017-18195
CVE-2017-18195—
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enum
28RISK
open ↗
Referência
CVE-2009-3975
CVE-2009-3975—
SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2013-6793
CVE-2013-6793—
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote a
23RISK
open ↗
Referência
CVE-2015-4667
CVE-2015-4667—
Multiple hardcoded credentials in Xsuite 2.x.
28RISK
open ↗
Referência
CVE-2017-13869
CVE-2017-13869—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
← previouspage 317 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.