Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2010-3129
Untrusted search path vulnerability in uTorrent 2.0.3 and earlier allows local users, and possibly remote attackers, to
23RISK
open ↗Referência
CVE-2017-1130
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it woul
43RISK
open ↗Referência
CVE-2010-3129
Untrusted search path vulnerability in uTorrent 2.0.3 and earlier allows local users, and possibly remote attackers, to
23RISK
open ↗Referência
CVE-2011-5135
Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in Doc
23RISK
open ↗Referência
CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISK
open ↗Referência✓ VexDay Proof
KingSoft - 'UpdateOcx2.dll SetUninstallName()' Heap Overflow (PoC)
Heap-based buffer overflow in the KUpdateObj2 Class ActiveX control in UpdateOcx2.dll in Beijing KingSoft Antivirus Onli
28RISK
open ↗Referência✓ VexDay Proof
Versant Object Database 7.0.1.3 - Commands Execution
Untrusted search path and argument injection vulnerability in the VersantD service in Versant Object Database 7.0.1.3 an
23RISK
open ↗Referência✓ VexDay Proof
asg-sentry 7.0.0 - Multiple Vulnerabilities
The FxIAList service in ASG-Sentry Network Manager 7.0.0 and earlier does require authentication, which allows remote at
23RISK
open ↗Referência
CVE-2009-4057
SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.1 for Joomla! allows remot
23RISK
open ↗Referência
CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISK
open ↗Referência
CVE-2020-6170
An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cl
23RISK
open ↗Referência✓ VexDay Proof
EQdkp 1.3.0 - 'dbal.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execu
23RISK
open ↗Referência
CVE-2017-6104
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
23RISK
open ↗Referência
CVE-2020-3153
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
83RISK
open ↗Referência
CVE-2013-4097
ServerAdmin/TestDRConnection.jsp in DS3 Authentication Server allows remote attackers to obtain sensitive information vi
23RISK
open ↗Referência
CVE-2026-112029
diem-project diem SHA1 PluginDmUser.class.php weak password hash
28RISK
open ↗Referência
CVE-2014-2588
Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated user
23RISK
open ↗Referência
CVE-2026-112027
light0011 cms Uploadify check-exists.php file_exists file information disclosure
33RISK
open ↗Referência✓ VexDay Proof
WordPress Core 2.2 - 'xmlrpc.php' SQL Injection
SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2009-4198
SQL injection vulnerability in my_orders.php in MyMiniBill allows remote authenticated users to execute arbitrary SQL co
23RISK
open ↗Referência
CVE-2013-1594
An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wire
23RISK
open ↗Referência
CVE-2011-5170
Stack-based buffer overflow in Castillo Bueno Systems CCMPlayer 1.5 allows remote attackers to execute arbitrary code vi
50RISK
open ↗Referência
CVE-2014-2588
Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated user
23RISK
open ↗Referência✓ VexDay Proof
Jasmine CMS 1.0 - SQL Injection / Remote Code Execution
Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrat
23RISK
open ↗Referência
CVE-2012-4032
Open redirect vulnerability in the login page in WebsitePanel before 1.2.2.1 allows remote attackers to redirect users t
43RISK
open ↗Referência✓ VexDay Proof
EasyGallery 5.0tr - Multiple Vulnerabilities
SQL injection vulnerability in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allows remote
23RISK
open ↗Referência✓ VexDay Proof
Fully Modded phpBB - 'kb.php' SQL Injection
SQL injection vulnerability in kb.php in Fully Modded phpBB (phpbbfm) 80220 allows remote attackers to execute arbitrary
23RISK
open ↗Referência✓ VexDay Proof
PHP 5.2.6 - 'error_log' Safe_mode Bypass
PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_f
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.