Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2026-3485
CVE-2026-3485CRITICAL
D-Link DIR-868L SSDP Service sub_1BF84 os command injection
48RISK
open ↗
Referência
CVE-2019-12962
CVE-2019-12962—
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
38RISK
open ↗
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2017-11661
CVE-2017-11661—
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory
28RISK
open ↗
Referência
CVE-2019-1674
CVE-2019-1674HIGH
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability
41RISK
open ↗
Referência
CVE-2019-10846
CVE-2019-10846—
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and passw
23RISK
open ↗
Referência✓ VexDay Proof
ravennuke 2.3.0 - Multiple Vulnerabilities
CVE-2009-0677—webappsphp
avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remo
23RISK
open ↗
Referência
CVE-2012-6622
CVE-2012-6622—
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin be
23RISK
open ↗
Referência
CVE-2017-20216
CVE-2017-20216CRITICAL
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection
53RISK
open ↗
Referência✓ VexDay Proof
ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion
CVE-2008-3368—webappsphp
PHP remote file inclusion vulnerability in tools/packages/import.php in ATutor 1.6.1 pl1 and earlier allows remote authe
23RISK
open ↗
Referência
CVE-2010-4143
CVE-2010-4143—
SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Referência
CVE-2013-3075
CVE-2013-3075—
Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities
28RISK
open ↗
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2010-4170
CVE-2010-4170—
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allow
38RISK
open ↗
Referência
CVE-2010-4186
CVE-2010-4186—
SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10
23RISK
open ↗
Referência
CVE-2026-13541
CVE-2026-13541MEDIUM
itsourcecode Hospital Management System doctorchangepassword.php sql injection
33RISK
open ↗
Referência
CVE-2014-9349
CVE-2014-9349—
Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2015-5999
CVE-2015-5999—
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2
23RISK
open ↗
Referência
CVE-2010-4513
CVE-2010-4513—
Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to
23RISK
open ↗
Referência
CVE-2012-0407
CVE-2012-0407—
Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote att
23RISK
open ↗
Referência
CVE-2018-12520
CVE-2018-12520—
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seede
28RISK
open ↗
Referência
CVE-2018-17376
CVE-2018-17376—
SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter
23RISK
open ↗
Referência
CVE-2026-89080
CVE-2026-89080HIGH
Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion
41RISK
open ↗
Referência
CVE-2018-6947
CVE-2018-6947—
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
23RISK
open ↗
Referência
CVE-2018-6947
CVE-2018-6947—
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
23RISK
open ↗
Referência
CVE-2019-1010124
CVE-2019-1010124—
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to
23RISK
open ↗
Referência
CVE-2026-90514
CVE-2026-90514MEDIUM
SourceCodester School Registration and Fee System save_stud.php sql injection
33RISK
open ↗
Referência
CVE-2011-4062
CVE-2011-4062—
Buffer overflow in the kernel in FreeBSD 7.3 through 9.0-RC1 allows local users to cause a denial of service (panic) or
23RISK
open ↗
← previouspage 390 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.