Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2015-4682
CVE-2015-4682—
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation
23RISK
open ↗
Referência
CVE-2015-4682
CVE-2015-4682—
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation
23RISK
open ↗
Referência
CVE-2016-3962
CVE-2016-3962—
Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTI
23RISK
open ↗
Referência
CVE-2008-1866
CVE-2008-1866—
admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote
23RISK
open ↗
Referência
CVE-2017-6096
CVE-2017-6096—
A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/list
23RISK
open ↗
Referência
CVE-2021-26855
CVE-2021-26855CRITICALunder attackransomware
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
Referência✓ VexDay Proof
PLog 1.0.6 - 'albumID' SQL Injection
CVE-2008-2629—webappsphp
SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2023-4548
CVE-2023-4548MEDIUM
SPA-Cart eCommerce CMS GET Parameter search sql injection
45RISK
open ↗
Referência
CVE-2026-79996
CVE-2026-79996HIGH
User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
41RISK
open ↗
Referência
CVE-2010-1920
CVE-2010-1920—
Directory traversal vulnerability in scr/soustab.php in OpenMairie openAnnuaire 2.00, when register_globals is enabled,
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component beamospetition 1.0.12 - SQL Injection / Cross-Site Scripting
CVE-2009-0377—webappsphp
SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attack
23RISK
open ↗
Referência
CVE-2012-1663
CVE-2012-1663—
Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (app
23RISK
open ↗
Referência
CVE-2012-2591
CVE-2012-2591—
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attack
23RISK
open ↗
Referência
CVE-2013-1852
CVE-2013-1852—
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote at
23RISK
open ↗
Referência
CVE-2015-1721
CVE-2015-1721—
The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and
23RISK
open ↗
Referência
CVE-2010-1920
CVE-2010-1920—
Directory traversal vulnerability in scr/soustab.php in OpenMairie openAnnuaire 2.00, when register_globals is enabled,
23RISK
open ↗
Referência
CVE-2010-1947
CVE-2010-1947—
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗
Referência
CVE-2004-1329
CVE-2004-1329—
Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd
23RISK
open ↗
Referência
CVE-2018-7746
CVE-2018-7746—
An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/chann
23RISK
open ↗
Referência
CVE-2022-25241
CVE-2022-25241—
In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).
23RISK
open ↗
Referência
CVE-2026-96257
CVE-2026-96257CRITICAL
Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow
48RISK
open ↗
Referência
CVE-2026-95271
CVE-2026-95271MEDIUM
dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication
33RISK
open ↗
Referência
CVE-2025-49619
CVE-2025-49619HIGH
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks suc
61RISK
open ↗
Referência✓ VexDay Proof
Nortel SSL VPN Linux Client 6.0.3 - Local Privilege Escalation
CVE-2007-1057—locallinux
The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 10
23RISK
open ↗
Referência
CVE-2026-16260
CVE-2026-16260MEDIUM
Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
33RISK
open ↗
Referência
CVE-2011-1865
CVE-2011-1865—
Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow
60RISK
open ↗
Referência
CVE-2026-95828
CVE-2026-95828MEDIUM
Mstfakts College-Management-System Authentication server.php session_start session fixiation
33RISK
open ↗
Referência
CVE-2010-0765
CVE-2010-0765—
fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote atta
23RISK
open ↗
Referência
CVE-2012-2941
CVE-2012-2941—
Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Pagode 0.5.8 - 'navigator_ok.php?asolute' Remote File Disclosure
CVE-2007-2200—webappsphp
Directory traversal vulnerability in navigator/navigator_ok.php in Pagode 0.5.8 allows remote attackers to read and poss
28RISK
open ↗
← previouspage 399 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.