Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,430cataloged exploits
35,543CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
22,301 exploits
Referência
CVE-2016-20038
CVE-2016-20038HIGH
yTree 1.94-1.1 Stack-Based Buffer Overflow
41RISK
open ↗
Referência
CVE-2016-20037
CVE-2016-20037HIGH
xwpe 1.5.30a-2.1 Stack-based Buffer Overflow
41RISK
open ↗
Referência
CVE-2026-4996
CVE-2026-4996MEDIUM
Sinaptik AI PandasAI pandasai-lancedb Extension lancedb.py get_relevant_docs_by_id sql injection
33RISK
open ↗
Referência
CVE-2026-4995
CVE-2026-4995MEDIUM
wandb OpenUI Window Message Event index.html cross site scripting
33RISK
open ↗
Referência
CVE-2026-4994
CVE-2026-4994MEDIUM
wandb OpenUI APIStatusError server.py generic_exception_handler information exposure
33RISK
open ↗
Referência
CVE-2026-4993
CVE-2026-4993MEDIUM
wandb OpenUI config.py hard-coded credentials
33RISK
open ↗
Referência
CVE-2025-15445
CVE-2025-15445MEDIUM
Restaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation
33RISK
open ↗
Referência
CVE-2026-9709
CVE-2026-9709HIGH
Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure
41RISK
open ↗
Referência
CVE-2018-18777
CVE-2018-18777—
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RISK
open ↗
Referência
CVE-2018-18777
CVE-2018-18777—
Directory traversal vulnerability in Microstrategy Web, version 7, in "/WebMstr7/servlet/mstrWeb" (in the parameter subp
43RISK
open ↗
Referência
CVE-2012-3810
CVE-2012-3810—
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
23RISK
open ↗
Referência
CVE-2018-18795
CVE-2018-18795—
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
23RISK
open ↗
Referência
CVE-2018-18795
CVE-2018-18795—
School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
23RISK
open ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗
Referência
CVE-2018-18798
CVE-2018-18798—
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RISK
open ↗
Referência
CVE-2018-18798
CVE-2018-18798—
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RISK
open ↗
Referência
CVE-2012-4279
CVE-2012-4279—
Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência✓ VexDay Proof
VMware Inc 6.0.0 - CreateProcess Remote Code Execution
CVE-2007-4155—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll in EMC VMware 6.0.0 allows remote attac
23RISK
open ↗
Referência
CVE-2012-4280
CVE-2012-4280—
Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote
23RISK
open ↗
Referência✓ VexDay Proof
paBugs 2.0 Beta 3 - 'main.php?cid' SQL Injection
CVE-2007-4183—webappsphp
SQL injection vulnerability in main.php in paBugs 2.0 Beta 3 and earlier allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2018-19571
CVE-2018-19571—
GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an
28RISK
open ↗
Referência
CVE-2018-19752
CVE-2018-19752—
DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.
38RISK
open ↗
Referência✓ VexDay Proof
FrontAccounting 1.12 build 31 - Remote File Inclusion
CVE-2007-4279—webappsphp
PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execut
45RISK
open ↗
Referência
CVE-2018-19913
CVE-2018-19913—
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
23RISK
open ↗
Referência
CVE-2018-20219
CVE-2018-20219—
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de
28RISK
open ↗
Referência
CVE-2018-20250
CVE-2018-20250HIGHunder attackransomware
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
Referência
CVE-2018-20250
CVE-2018-20250HIGHunder attackransomware
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
Referência
CVE-2018-20250
CVE-2018-20250HIGHunder attackransomware
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
Referência
CVE-2010-5285
CVE-2010-5285—
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the a
23RISK
open ↗
← previouspage 448 / 744next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.