Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,559cataloged exploits
34,978CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,960VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2026-67609
Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
41RISK
open ↗Referência
CVE-2017-0299
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗Referência✓ VexDay Proof
AllMyLinks 0.5.0 - 'index.php' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute
23RISK
open ↗Referência
CVE-2012-1904
mp4fformat.dll in the QuickTime File Format plugin in RealNetworks RealPlayer 15 and earlier, and RealPlayer SP 1.1.4 Bu
23RISK
open ↗Referência
CVE-2018-4218
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud
23RISK
open ↗Referência
CVE-2015-1057
Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary w
23RISK
open ↗Referência
CVE-2016-1819
Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 1
23RISK
open ↗Referência
CVE-2016-1819
Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 1
23RISK
open ↗Referência
CVE-2014-1842
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISK
open ↗Referência✓ VexDay Proof
BaoFeng2 - 'mps.dll' ActiveX Multiple Remote Buffer Overflows (PoC)
Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown imp
23RISK
open ↗Referência
CVE-2013-7187
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers
23RISK
open ↗Referência
CVE-2013-7187
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers
23RISK
open ↗Referência
BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.24750 and earlier that allows an auth
28RISK
open ↗Referência✓ VexDay Proof
dBpowerAMP Audio Player 2 - '.m3u' Remote Buffer Overflow
Buffer overflow in dBpowerAMP Audio Player Release 2 allows remote attackers to execute arbitrary code via a .M3U file w
23RISK
open ↗Referência✓ VexDay Proof
CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and e
23RISK
open ↗Referência✓ VexDay Proof
Yerba SACphp 6.3 - Local File Inclusion
Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote atta
23RISK
open ↗Referência✓ VexDay Proof
mxCamArchive 2.2 - Bypass Configuration Download
Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to
23RISK
open ↗Referência
CVE-2017-13855
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗Referência
CVE-2016-9488
ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
23RISK
open ↗Referência
CVE-2016-9488
ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
23RISK
open ↗Referência
CVE-2015-3325
SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to
23RISK
open ↗Referência
CVE-2017-16952
KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.
23RISK
open ↗Referência
CVE-2019-3759
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 cont
33RISK
open ↗Referência
CVE-2014-4613
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RISK
open ↗Referência
CVE-2014-4613
Cross-site request forgery (CSRF) vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attacke
23RISK
open ↗Referência✓ VexDay Proof
Magic CMS 4.2.747 - 'mysave.php' Remote File Inclusion
PHP remote file inclusion vulnerability in mysave.php in Magic CMS 4.2.747 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
Amber Script 1.0 - 'show_content.php?id' Local File Inclusion
Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to inc
23RISK
open ↗Referência✓ VexDay Proof
XOOPS mod_gallery Zend_Hash_key + Extract - Remote File Inclusion
PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when registe
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.