Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2020-26829

CVE-2020-26829CRITICAL

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary conne

48RISK

open ↗

Referência

CVE-2018-12052

CVE-2018-12052—

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.

23RISK

open ↗

Referência

CVE-2026-90682

CVE-2026-90682MEDIUM

Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow

33RISK

open ↗

Referência

CVE-2026-14753

CVE-2026-14753MEDIUM

mjperpinosa stumasy Note Handler/Assignment notes authorization

33RISK

open ↗

Referência

CVE-2017-2473

CVE-2017-2473—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS b

23RISK

open ↗

Referência

CVE-2018-6671

CVE-2018-6671MEDIUM

SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability

33RISK

open ↗

Referência

CVE-2014-125117

CVE-2014-125117CRITICAL

D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

63RISK

open ↗

Referência

CVE-2014-125117

CVE-2014-125117CRITICAL

D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

63RISK

open ↗

Referência

CVE-2014-125117

CVE-2014-125117CRITICAL

D-Link info.cgi POST Request Stack-Based Buffer Overflow RCE

63RISK

open ↗

Referência

CVE-2025-7097

CVE-2025-7097CRITICAL

Comodo Internet Security Premium Manifest File cis_update_x64.xml os command injection

48RISK

open ↗

Referência

CVE-2025-7097

CVE-2025-7097CRITICAL

Comodo Internet Security Premium Manifest File cis_update_x64.xml os command injection

48RISK

open ↗

Referência

CVE-2019-10226

CVE-2019-10226—

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to th

23RISK

open ↗

Referência

CVE-2011-3492

CVE-2011-3492—

Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial

60RISK

open ↗

Referência

CVE-2011-4024

CVE-2011-4024—

Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers t

23RISK

open ↗

Referência

CVE-2024-23749

CVE-2024-23749HIGH

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insuffic

41RISK

open ↗

Referência

CVE-2019-10226

CVE-2019-10226—

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to th

23RISK

open ↗

Referência✓ VexDay Proof

DivX Web Player 1.3.0 - 'npdivx32.dll' Remote Denial of Service

CVE-2007-1294—doswindows

A certain ActiveX control in the DivXBrowserPlugin (npdivx32.dll) in DivX Web Player, as distributed with DivX Player 1.

23RISK

open ↗

Referência✓ VexDay Proof

Live Music Plus 1.1.0 - 'id' SQL Injection

CVE-2008-3352—webappsphp

SQL injection vulnerability in index.php in Live Music Plus 1.1.0 allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2010-1466

CVE-2010-1466—

Directory traversal vulnerability in scr/soustab.php in openUrgence Vaccin 1.03 allows remote attackers to read arbitrar

23RISK

open ↗

Referência

CVE-2006-6566

CVE-2006-6566—

PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module

23RISK

open ↗

Referência

CVE-2026-90572

CVE-2026-90572MEDIUM

davenardella snap7 s7_micro_client.cpp opUpload memory corruption

33RISK

open ↗

Referência

CVE-2019-8937

CVE-2019-8937—

HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel

38RISK

open ↗

Referência

CVE-2013-4898

CVE-2013-4898—

Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine

23RISK

open ↗

Referência

CVE-2014-2586

CVE-2014-2586—

Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta

23RISK

open ↗

Referência

CVE-2010-4335

CVE-2010-4335—

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows re

50RISK

open ↗

Referência

CVE-2019-8937

CVE-2019-8937—

HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel

38RISK

open ↗

Referência

CVE-2014-6619

CVE-2014-6619—

Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a

23RISK

open ↗

Referência

CVE-2014-9580

CVE-2014-9580—

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2026-13590

CVE-2026-13590MEDIUM

seladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow

33RISK

open ↗

Referência

CVE-2026-40524

CVE-2026-40524HIGH

FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.