Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
22,166 exploits
Referência
CVE-2026-65918
CVE-2026-65918HIGH
PyTorch torchvision GIF Decoder Out-of-bounds Heap Read
41RISK
open ↗
Referência
CVE-2026-65702
CVE-2026-65702HIGH
Vanna 2.0.2 Path Traversal via FileSystemConversationStore
41RISK
open ↗
Referência
CVE-2026-65701
CVE-2026-65701CRITICAL
SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route
48RISK
open ↗
Referência
CVE-2010-4864
CVE-2010-4864—
SQL injection vulnerability in the Club Manager (com_clubmanager) component for Joomla! allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2010-4866
CVE-2010-4866—
SQL injection vulnerability in index.php in Chipmunk Board 1.3 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-4869
CVE-2010-4869—
SQL injection vulnerability in index.php in DBHcms 1.1.4 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2015-2878
CVE-2015-2878—
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2009-2787
CVE-2009-2787—
Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, an
23RISK
open ↗
Referência
CVE-2009-2787
CVE-2009-2787—
Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, an
23RISK
open ↗
Referência
CVE-2018-4230
CVE-2018-4230—
An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "NVIDIA Grap
23RISK
open ↗
Referência
CVE-2022-0847
CVE-2022-0847HIGHunder attack
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗
Referência✓ VexDay Proof
PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion
CVE-2007-3270—webappsphp
PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2012-6667
CVE-2012-6667—
Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows r
23RISK
open ↗
Referência
CVE-2018-7703
CVE-2018-7703—
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2013-7136
CVE-2013-7136—
The UPC Ireland Cisco EPC 2425 router (aka Horizon Box) does not have a sufficiently large number of possible WPA-PSK pa
23RISK
open ↗
Referência
CVE-2017-12954
CVE-2017-12954—
The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Wordspew - SQL Injection
CVE-2008-0682—webappsphp
SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers
23RISK
open ↗
Referência
CVE-2017-12953
CVE-2017-12953—
The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial
23RISK
open ↗
Referência
CVE-2014-6312
CVE-2014-6312—
Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before
23RISK
open ↗
Referência✓ VexDay Proof
PostcardMentor - 'cat_fldAuto' SQL Injection
CVE-2008-2132—webappsasp
SQL injection vulnerability in step1.asp in Systementor PostcardMentor allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-4927
CVE-2010-4927—
SQL injection vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2010-4927
CVE-2010-4927—
SQL injection vulnerability in the Restaurant Guide (com_restaurantguide) component 1.0.0 for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2015-7984
CVE-2015-7984—
Multiple cross-site request forgery (CSRF) vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Hor
23RISK
open ↗
Referência
CVE-2013-4900
CVE-2013-4900—
Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remote
23RISK
open ↗
Referência
CVE-2016-7225
CVE-2016-7225—
Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to
23RISK
open ↗
Referência✓ VexDay Proof
RunCMS 1.6 - Multiple Vulnerabilities
CVE-2007-6545—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary we
23RISK
open ↗
Referência
CVE-2016-7224
CVE-2016-7224—
Virtual Hard Disk Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 151
23RISK
open ↗
Referência
CVE-2012-4260
CVE-2012-4260—
Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1)
23RISK
open ↗
Referência✓ VexDay Proof
My PHP Indexer 1.0 - 'index.php' Local File Download
CVE-2008-6183—webappsphp
Multiple directory traversal vulnerabilities in index.php in My PHP Indexer 1.0 allow remote attackers to read arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Belkin Wireless G Router / ADSL2 Modem - Authentication Bypass
CVE-2008-7115—remotehardware
The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attack
23RISK
open ↗
← previouspage 354 / 739next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.