Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2012-3839
CVE-2012-3839—
Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to e
23RISK
open ↗
Referência
CVE-2012-5294
CVE-2012-5294—
SQL injection vulnerability in art_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2016-9299
CVE-2016-9299—
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
60RISK
open ↗
Referência
CVE-2014-0196
CVE-2014-0196MEDIUMunder attack
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
68RISK
open ↗
Referência
CVE-2022-44149
CVE-2022-44149HIGH
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by
53RISK
open ↗
Referência
CVE-2018-18805
CVE-2018-18805—
Point Of Sales 1.0 allows SQL injection via the login screen, related to LoginForm1.vb.
23RISK
open ↗
Referência✓ VexDay Proof
BinGo News 3.01 - 'bnrep' Remote File Inclusion
CVE-2006-4648—webappsphp
PHP remote file inclusion vulnerability in bp_ncom.php in BinGo News (BP News) 3.01 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2018-18857
CVE-2018-18857—
Multiple local privilege escalation vulnerabilities have been identified in the LiquidVPN client through 1.37 for macOS.
23RISK
open ↗
Referência
CVE-2018-6180
CVE-2018-6180—
A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password fo
23RISK
open ↗
Referência✓ VexDay Proof
Dragoon 0.1 - 'root' Remote File Inclusion
CVE-2008-1773—webappsphp
PHP remote file inclusion vulnerability in includes/header.inc.php in Dragoon 0.1 allows remote attackers to execute arb
28RISK
open ↗
Referência✓ VexDay Proof
iScripts Socialware - 'id' SQL Injection
CVE-2008-1790—webappsphp
Unrestricted file upload vulnerability in iScripts SocialWare allows remote authenticated administrators to upload arbit
23RISK
open ↗
Referência
CVE-2010-5284
CVE-2010-5284—
Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web s
23RISK
open ↗
Referência
CVE-2012-5322
CVE-2012-5322—
Multiple cross-site scripting (XSS) vulnerabilities in Xavi X7968 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2012-5330
CVE-2012-5330—
Multiple cross-site scripting (XSS) vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2016-20072
CVE-2016-20072HIGH
BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid
41RISK
open ↗
Referência✓ VexDay Proof
Crazy Goomba 1.2.1 - 'id' SQL Injection
CVE-2008-1934—webappsphp
SQL injection vulnerability in commentaires.php in Crazy Goomba 1.2.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2015-3245
CVE-2015-3245—
Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in t
38RISK
open ↗
Referência
CVE-2014-10013
CVE-2014-10013—
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Grape Statistics 0.2a - 'location' Remote File Inclusion
CVE-2008-1963—webappsphp
PHP remote file inclusion vulnerability in includes/functions.php in Quate Grape Web Statistics 0.2a allows remote attac
35RISK
open ↗
Referência✓ VexDay Proof
SubEdit Player build 4066 - subtitle Buffer Overflow (PoC)
CVE-2008-1973—doswindows
Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (c
23RISK
open ↗
Referência
CVE-2012-5874
CVE-2012-5874—
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Eli
23RISK
open ↗
Referência
CVE-2017-0143
CVE-2017-0143HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2014-10020
CVE-2014-10020—
SQL injection vulnerability in login.php in Simple e-document 1.31 allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
CVE-2014-2533
CVE-2014-2533—
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
38RISK
open ↗
Referência
CVE-2012-5875
CVE-2012-5875—
Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1
28RISK
open ↗
Referência
CVE-2014-2671
CVE-2014-2671—
Microsoft Windows Media Player (WMP) 11.0.5721.5230 allows remote attackers to cause a denial of service (memory corrupt
35RISK
open ↗
Referência
CVE-2026-2601
CVE-2026-2601MEDIUM
Missing Authorization in GitLab
33RISK
open ↗
Referência
CVE-2026-4868
CVE-2026-4868HIGH
Authorization Bypass Through User-Controlled Key in GitLab
41RISK
open ↗
Referência
CVE-2018-20525
CVE-2018-20525—
Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php.
28RISK
open ↗
Referência
CVE-2018-6394
CVE-2018-6394—
SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.
23RISK
open ↗
← previouspage 515 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.