Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2026-97359
CVE-2026-97359CRITICAL
HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
63RISK
open ↗
Referência
CVE-2014-3441
CVE-2014-3441—
codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash)
23RISK
open ↗
Referência
CVE-2018-16134
CVE-2018-16134—
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
23RISK
open ↗
Referência
CVE-2018-8410
CVE-2018-8410—
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory
23RISK
open ↗
Referência
CVE-2023-30868
CVE-2023-30868HIGH
WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)
56RISK
open ↗
Referência
CVE-2019-7438
CVE-2019-7438—
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.
23RISK
open ↗
Referência
CVE-2014-9143
CVE-2014-9143—
Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect us
23RISK
open ↗
Referência
CVE-2026-86319
CVE-2026-86319MEDIUM
java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
33RISK
open ↗
Referência
CVE-2026-82813
CVE-2026-82813MEDIUM
BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity
33RISK
open ↗
Referência
CVE-2026-100314
CVE-2026-100314MEDIUM
mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection
33RISK
open ↗
Referência
CVE-2015-2554
CVE-2015-2554—
The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10
23RISK
open ↗
Referência
CVE-2015-6098
CVE-2015-6098—
Buffer overflow in the Network Driver Interface Standard (NDIS) implementation in Microsoft Windows Vista SP2, Windows S
23RISK
open ↗
Referência
CVE-2026-97182
CVE-2026-97182MEDIUM
halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
33RISK
open ↗
Referência✓ VexDay Proof
simple file manager 0.24a - Multiple Vulnerabilities
CVE-2006-6376—webappsphp
Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use
23RISK
open ↗
Referência
CVE-2009-3669
CVE-2009-3669—
SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remot
23RISK
open ↗
Referência✓ VexDay Proof
CentiPaid 1.4.2 - 'centipaid_class.php' Remote File Inclusion
CVE-2006-6976—webappsphp
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-4974
CVE-2010-4974—
SQL injection vulnerability in info.php in BrotherScripts (BS) and ScriptsFeed Auto Dealer allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2014-9143
CVE-2014-9143—
Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect us
23RISK
open ↗
Referência✓ VexDay Proof
e-Vision CMS 2.02 - SQL Injection / Remote Code Execution
CVE-2007-3251—webappsphp
Multiple directory traversal vulnerabilities in e-Vision CMS 2.02 and earlier allow remote attackers to (1) include and
23RISK
open ↗
Referência✓ VexDay Proof
Apple Safari - RSS 'feed://' Buffer Overflow via libxml2 (PoC)
CVE-2008-3529—doswindows
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-de
28RISK
open ↗
Referência
CVE-2009-3670
CVE-2009-3670—
Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a
23RISK
open ↗
Referência
CVE-2009-4892
CVE-2009-4892—
SQL injection vulnerability in Content Management System WEBjump! allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2008-5821
CVE-2008-5821—
Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause
23RISK
open ↗
Referência
CVE-2025-15255
CVE-2025-15255CRITICAL
Tenda W6-S R7websSsecurityHandler httpd stack-based overflow
48RISK
open ↗
Referência
CVE-2026-12065
CVE-2026-12065LOW
Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme
28RISK
open ↗
Referência
CVE-2017-9260
CVE-2017-9260—
The TDStretchSSE::calcCrossCorr function in source/SoundTouch/sse_optimized.cpp in SoundTouch 1.9.2 allows remote attack
23RISK
open ↗
Referência
CVE-2015-2797
CVE-2015-2797—
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 502
60RISK
open ↗
Referência
CVE-2012-10060
CVE-2012-10060CRITICAL
Sysax Multi Server < 5.55 SSH Username Buffer Overflow
63RISK
open ↗
Referência
CVE-2012-10060
CVE-2012-10060CRITICAL
Sysax Multi Server < 5.55 SSH Username Buffer Overflow
63RISK
open ↗
Referência
CVE-2006-5762
CVE-2006-5762—
PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers
23RISK
open ↗
← previouspage 495 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.