Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits

35,420CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência

CVE-2020-11107

CVE-2020-11107—

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged

28RISK

open ↗

Referência

CVE-2011-1669

CVE-2011-1669—

Directory traversal vulnerability in wp-download.php in the WP Custom Pages module 0.5.0.1 for WordPress allows remote a

43RISK

open ↗

Referência

CVE-2013-0662

CVE-2013-0662—

Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow

28RISK

open ↗

Referência

CVE-2013-0662

CVE-2013-0662—

Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow

28RISK

open ↗

Referência

CVE-2020-2230

CVE-2020-2230—

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in

45RISK

open ↗

Referência

CVE-2014-2668

CVE-2014-2668—

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via t

28RISK

open ↗

Referência

CVE-2014-2668

CVE-2014-2668—

Apache CouchDB 1.5.0 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via t

28RISK

open ↗

Referência

CVE-2020-23522

CVE-2020-23522—

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

23RISK

open ↗

Referência

CVE-2015-1579

CVE-2015-1579—

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra

43RISK

open ↗

Referência✓ VexDay Proof

MOG-WebShop - 'index.php?group' SQL Injection

CVE-2007-6466—webappsphp

Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2017-0120

CVE-2017-0120—

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

28RISK

open ↗

Referência

CVE-2009-2338

CVE-2009-2338—

Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is

23RISK

open ↗

Referência

CVE-2017-14143

CVE-2017-14143—

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh

60RISK

open ↗

Referência

CVE-2017-14143

CVE-2017-14143—

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh

60RISK

open ↗

Referência

CVE-2026-2441

CVE-2026-2441HIGHunder attack

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside

76RISK

open ↗

Referência

CVE-2025-34392

CVE-2025-34392CRITICAL

Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE

53RISK

open ↗

Referência

CVE-2017-2985

CVE-2017-2985—

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript

28RISK

open ↗

Referência

CVE-2016-3715

CVE-2016-3715MEDIUMunder attack

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary fi

85RISK

open ↗

Referência

CVE-2018-0878

CVE-2018-0878LOW

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Window

33RISK

open ↗

Referência✓ VexDay Proof

gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion

CVE-2007-6476—webappsphp

GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php

23RISK

open ↗

Referência

CVE-2009-1493

CVE-2009-1493—

The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and

28RISK

open ↗

Referência

CVE-2017-6542

CVE-2017-6542—

The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large

28RISK

open ↗

Referência✓ VexDay Proof

falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting

CVE-2007-6490—webappsphp

Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a passw

23RISK

open ↗

Referência

Tailor MS 1.0 - Reflected Cross-Site Scripting

CVE-2020-23835MEDIUMwebappsphp

A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Mana

33RISK

open ↗

Referência

CVE-2015-3302

CVE-2015-3302—

The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1

28RISK

open ↗

Referência

CVE-2020-24186

CVE-2020-24186CRITICAL

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

Referência

CVE-2009-1330

CVE-2009-1330—

Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long fil

28RISK

open ↗

Referência

CVE-2009-4437

CVE-2009-4437—

Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2016-6272

CVE-2016-6272—

XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing s

28RISK

open ↗

Referência

CVE-2018-20525

CVE-2018-20525—

Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.