Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2014-1216
CVE-2014-1216—
FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAN
23RISK
open ↗
Referência
CVE-2026-81402
CVE-2026-81402CRITICAL
DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2015-6912
CVE-2015-6912—
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharact
28RISK
open ↗
Referência
CVE-2013-10069
CVE-2013-10069CRITICAL
D-Link Devices Unauthenticated RCE
68RISK
open ↗
Referência
CVE-2013-10069
CVE-2013-10069CRITICAL
D-Link Devices Unauthenticated RCE
68RISK
open ↗
Referência
CVE-2013-10069
CVE-2013-10069CRITICAL
D-Link Devices Unauthenticated RCE
68RISK
open ↗
Referência
CVE-2018-8468
CVE-2018-8468—
An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privil
28RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6494—webappsasp
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/a
28RISK
open ↗
Referência
CVE-2020-3118
CVE-2020-3118HIGHunder attack
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
76RISK
open ↗
Referência
CVE-2019-17132
CVE-2019-17132—
vBulletin through 5.5.4 mishandles custom avatars.
28RISK
open ↗
Referência
CVE-2019-8387
CVE-2019-8387—
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
35RISK
open ↗
Referência
CVE-2023-0159
CVE-2023-0159—
Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE
50RISK
open ↗
Referência
CVE-2017-17739
CVE-2017-17739—
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html
28RISK
open ↗
Referência
CVE-2026-80494
CVE-2026-80494HIGH
Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
41RISK
open ↗
Referência✓ VexDay Proof
Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload
CVE-2008-0457—remotewindows
Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, a
28RISK
open ↗
Referência✓ VexDay Proof
AspWebCalendar 2008 - Arbitrary File Upload
CVE-2008-2832—webappsasp
Unrestricted file upload vulnerability in calendar_admin.asp in Full Revolution aspWebCalendar 2008 allows remote attack
28RISK
open ↗
Referência
CVE-2018-15120
CVE-2018-15120—
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denia
28RISK
open ↗
Referência✓ VexDay Proof
Okul Otomasyon Portal 2.0 - SQL Injection
CVE-2007-5490—webappsphp
SQL injection vulnerability in default.asp in Okul Otomasyon Portal 2.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2017-2523
CVE-2017-2523—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS
28RISK
open ↗
Referência
CVE-2018-18957
CVE-2018-18957—
An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goose_pu
28RISK
open ↗
Referência
CVE-2019-10709
CVE-2019-10709—
AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP devic
28RISK
open ↗
Referência
CVE-2019-6989
CVE-2019-6989—
TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispos
28RISK
open ↗
Referência
CVE-2019-6989
CVE-2019-6989—
TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispos
28RISK
open ↗
Referência
CVE-2010-0372
CVE-2010-0372—
SQL injection vulnerability in the Articlemanager (com_articlemanager) component for Joomla! allows remote attackers to
23RISK
open ↗
Referência
CVE-2026-83532
CVE-2026-83532MEDIUM
Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
33RISK
open ↗
Referência
CVE-2026-110015
CVE-2026-110015HIGH
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
41RISK
open ↗
Referência
CVE-2013-7186
CVE-2013-7186—
Buffer overflow in Steinberg MyMp3PRO 5.0 (Build 5.1.0.21) allows remote attackers to execute arbitrary code via a long
28RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_school 1.4 - 'classid' SQL Injection
CVE-2009-2014—webappsphp
SQL injection vulnerability in the ComSchool (com_school) component 1.4 for Joomla! allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2009-2305
CVE-2009-2305—
The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //
23RISK
open ↗
Referência✓ VexDay Proof
Bytehoard 2.1 - 'server.php' Remote File Inclusion
CVE-2006-2849—webappsphp
PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attac
28RISK
open ↗
← previouspage 389 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.