Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,620cataloged exploits

35,647CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecent popular risk

22,429 exploits

Referência

CVE-2016-0099

CVE-2016-0099HIGHunder attackransomware

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8

98RISK

open ↗

Referência

CVE-2013-7409

CVE-2013-7409—

Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possib

50RISK

open ↗

Referência

CVE-2013-7409

CVE-2013-7409—

Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possib

50RISK

open ↗

Referência

CVE-2012-6430

CVE-2012-6430—

Cross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded befor

23RISK

open ↗

Referência

CVE-2025-2747

CVE-2025-2747CRITICALunder attack

Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass

100RISK

open ↗

Referência✓ VexDay Proof

e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection

CVE-2009-1409—webappsphp

SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and m

23RISK

open ↗

Referência

CVE-2018-0775

CVE-2018-0775—

Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due t

35RISK

open ↗

Referência

CVE-2018-0774

CVE-2018-0774—

Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due t

35RISK

open ↗

Referência

CVE-2019-18426

CVE-2019-18426HIGHunder attack

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.

83RISK

open ↗

Referência

CVE-2009-3052

CVE-2009-3052—

SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB

23RISK

open ↗

Referência

CVE-2010-1554

CVE-2010-1554—

Stack-based buffer overflow in getnnmdata.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows r

50RISK

open ↗

Referência

CVE-2016-6662

CVE-2016-6662—

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2

35RISK

open ↗

Referência✓ VexDay Proof

Quick.CMS.Lite 0.5 - 'id' SQL Injection

CVE-2009-1410—webappsphp

SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2018-0767

CVE-2018-0767—

Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain info

35RISK

open ↗

Referência

CVE-2017-11811

CVE-2017-11811—

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker

35RISK

open ↗

Referência

CVE-2012-3399

CVE-2012-3399—

Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the

50RISK

open ↗

Referência

CVE-2011-3322

CVE-2011-3322—

Core Server HMI Service (Coreservice.exe) in Scadatec Limited Procyon SCADA 1.06, and other versions before 1.14, allows

50RISK

open ↗

Referência

CVE-2024-3272

CVE-2024-3272CRITICALunder attack

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

100RISK

open ↗

Referência✓ VexDay Proof

WM Downloader - '.m3u' Local Stack Overflow (PoC)

CVE-2009-1327—doswindows

Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a

23RISK

open ↗

Referência

CVE-2019-6977

CVE-2019-6977—

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch funct

35RISK

open ↗

Referência

CVE-2019-6977

CVE-2019-6977—

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch funct

35RISK

open ↗

Referência

CVE-2018-19422

CVE-2018-19422—

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, beca

50RISK

open ↗

Referência

CVE-2018-19422

CVE-2018-19422—

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, beca

50RISK

open ↗

Referência✓ VexDay Proof

Apple Mac OSX - 'mount_smbfs' Local Stack Buffer Overflow

CVE-2007-3876—localosx

Stack-based buffer overflow in SMB in Apple Mac OS X 10.4.11 allows local users to execute arbitrary code via (1) a long

23RISK

open ↗

Referência✓ VexDay Proof

TFTP Server for Windows 1.4 - ST Remote BSS Overflow

CVE-2008-2161—remotewindows

Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execut

50RISK

open ↗

Referência

CVE-2017-11861

CVE-2017-11861—

Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker t

35RISK

open ↗

Referência

CVE-2018-8735

CVE-2018-8735—

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut

50RISK

open ↗

Referência

CVE-2018-8735

CVE-2018-8735—

Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut

50RISK

open ↗

Referência

CVE-2016-1593

CVE-2016-1593—

Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remot

50RISK

open ↗

Referência

CVE-2026-7060

CVE-2026-7060MEDIUM

liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.