Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2018-8468
CVE-2018-8468—
An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privil
28RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6494—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/a
28RISK
open ↗
Referência
CVE-2020-3118
CVE-2020-3118HIGHunder attack
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
76RISK
open ↗
Referência
CVE-2019-17132
CVE-2019-17132—
vBulletin through 5.5.4 mishandles custom avatars.
28RISK
open ↗
Referência
CVE-2019-8387
CVE-2019-8387—
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
35RISK
open ↗
Referência
CVE-2023-0159
CVE-2023-0159—
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
50RISK
open ↗
Referência
CVE-2017-17739
CVE-2017-17739—
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html
28RISK
open ↗
Referência
CVE-2026-80494
CVE-2026-80494HIGH
Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
41RISK
open ↗
Referência✓ VexDay Proof
Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload
CVE-2008-0457—remotewindows
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, a
28RISK
open ↗
Referência✓ VexDay Proof
AspWebCalendar 2008 - Arbitrary File Upload
CVE-2008-2832—webappsasp
Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attack
28RISK
open ↗
Referência
CVE-2019-12276
CVE-2019-12276—
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows
50RISK
open ↗
Referência
CVE-2023-26068
CVE-2023-26068CRITICAL
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).
68RISK
open ↗
Referência
CVE-2018-8947
CVE-2018-8947—
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easi
28RISK
open ↗
Referência
CVE-2020-1380
CVE-2020-1380HIGHunder attack
Scripting Engine Memory Corruption Vulnerability
76RISK
open ↗
Referência✓ VexDay Proof
WWWISIS 7.1 - 'IsisScript' Local File Disclosure / Cross-Site Scripting
CVE-2007-5455—webappscgi
Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitr
23RISK
open ↗
Referência✓ VexDay Proof
eXtremail 2.1.1 - 'memmove()' Remote Denial of Service
CVE-2007-5467—doslinux
Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execu
28RISK
open ↗
Referência
CVE-2019-19731
CVE-2019-19731—
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary loc
28RISK
open ↗
Referência
CVE-2019-9189
CVE-2019-9189—
Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when
28RISK
open ↗
Referência
CVE-2014-3976
CVE-2014-3976—
Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allow
28RISK
open ↗
Referência✓ VexDay Proof
RSS Simple News - SQL Injection
CVE-2008-6333—webappsphp
SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote att
23RISK
open ↗
Referência
CVE-2010-1957
CVE-2010-1957—
Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attack
43RISK
open ↗
Referência
CVE-2010-2847
CVE-2010-2847—
Multiple SQL injection vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allo
23RISK
open ↗
Referência
CVE-2013-3502
CVE-2013-3502—
monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to ex
50RISK
open ↗
Referência
CVE-2014-3976
CVE-2014-3976—
Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allow
28RISK
open ↗
Referência
CVE-2018-11492
CVE-2018-11492—
ASUS HG100 devices allow denial of service via an IPv4 packet flood.
28RISK
open ↗
Referência
CVE-2016-5725
CVE-2016-5725—
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allow
28RISK
open ↗
Referência
CVE-2018-11492
CVE-2018-11492—
ASUS HG100 devices allow denial of service via an IPv4 packet flood.
28RISK
open ↗
Referência
CVE-2017-2370
CVE-2017-2370—
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS
28RISK
open ↗
Referência
TylerTech Eagle 2018.3.11 - Remote Code Execution
CVE-2019-16112—webappsjava
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java objec
28RISK
open ↗
Referência
CVE-2020-24365
CVE-2020-24365—
An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic n
28RISK
open ↗
← previouspage 366 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.