Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2012-3810
CVE-2012-3810—
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
23RISK
open ↗
Referência
CVE-2013-2619
CVE-2013-2619—
Directory traversal vulnerability in Aspen before 0.22 allows remote attackers to read arbitrary files via a .. (dot dot
23RISK
open ↗
Referência
CVE-2012-4055
CVE-2012-4055—
SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2018-9155
CVE-2018-9155—
Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2018-9206
CVE-2018-9206—
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
open ↗
Referência✓ VexDay Proof
Wsn (Multiple Products) - Local File Inclusion / Code Execution
CVE-2008-3555—webappsphp
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3)
23RISK
open ↗
Referência
CVE-2017-0358
CVE-2017-0358HIGH
ntfs-3g: Modprobe influence vulnerability via environment variables
56RISK
open ↗
Referência
CVE-2026-84021
CVE-2026-84021MEDIUM
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL
33RISK
open ↗
Referência
CVE-2018-9445
CVE-2018-9445—
In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local
23RISK
open ↗
Referência✓ VexDay Proof
Vacation Rental Script 3.0 - 'id' SQL Injection
CVE-2008-3603—webappsphp
SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2012-4252
CVE-2012-4252—
Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the au
23RISK
open ↗
Referência
CVE-2026-82846
CVE-2026-82846MEDIUM
Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
33RISK
open ↗
Referência
CVE-2026-81348
CVE-2026-81348LOW
My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap
28RISK
open ↗
Referência
CVE-2008-3765
CVE-2008-3765—
SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2026-4935
CVE-2026-4935HIGH
SureTriggers < 1.1.23 – Unauthenticated SQLi
41RISK
open ↗
Referência✓ VexDay Proof
Quick Poll Script - 'id' SQL Injection
CVE-2008-3765—webappsphp
SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2024-33288
CVE-2024-33288HIGH
Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the
56RISK
open ↗
Referência
CVE-2023-42344
CVE-2023-42344HIGH
Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/
56RISK
open ↗
Referência
CVE-2026-15152
CVE-2026-15152MEDIUM
WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
33RISK
open ↗
Referência
CVE-2023-46453
CVE-2023-46453CRITICAL
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device
48RISK
open ↗
Referência
CVE-2026-13389
CVE-2026-13389MEDIUM
WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes
33RISK
open ↗
Referência
CVE-2026-14225
CVE-2026-14225LOW
Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass
28RISK
open ↗
Referência
CVE-2026-16062
CVE-2026-16062MEDIUM
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content
33RISK
open ↗
Referência
CVE-2012-4997
CVE-2012-4997—
Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary lo
23RISK
open ↗
Referência
CVE-2026-18958
CVE-2026-18958MEDIUM
imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection
33RISK
open ↗
Referência
CVE-2026-70636
CVE-2026-70636HIGH
Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint
41RISK
open ↗
Referência
CVE-2026-66007
CVE-2026-66007MEDIUM
Datasets Path Traversal via Unsanitized file_name Metadata
33RISK
open ↗
Referência
CVE-2026-5657
CVE-2026-5657MEDIUM
Double Free in Wireshark
33RISK
open ↗
Referência
CVE-2013-0230
CVE-2013-0230—
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP
50RISK
open ↗
Referência
CVE-2026-8985
CVE-2026-8985CRITICAL
Unauthenticated Command Injection
48RISK
open ↗
← previouspage 325 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.