Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
22,429 exploits
Referência
CVE-2017-8682
CVE-2017-8682—
Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold a
35RISK
open ↗
Referência
CVE-2009-2895
CVE-2009-2895—
SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2016-0170
CVE-2016-0170—
GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012
35RISK
open ↗
Referência
CVE-2020-16009
CVE-2020-16009HIGHunder attack
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl
83RISK
open ↗
Referência
CVE-2018-14392
CVE-2018-14392—
The New Threads plugin before 1.2 for MyBB has XSS.
35RISK
open ↗
Referência
CVE-2009-3642
CVE-2009-3642—
Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to exe
23RISK
open ↗
Referência
CVE-2023-4547
CVE-2023-4547LOW
SPA-Cart eCommerce CMS search cross site scripting
55RISK
open ↗
Referência
CVE-2017-9232
CVE-2017-9232—
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate pe
50RISK
open ↗
Referência
CVE-2021-40875
CVE-2021-40875—
Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac
50RISK
open ↗
Referência
CVE-2009-0182
CVE-2009-0182—
Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in
50RISK
open ↗
Referência
CVE-2025-48828
CVE-2025-48828CRITICAL
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t
75RISK
open ↗
Referência✓ VexDay Proof
Bitweaver 2.6 - 'saveFeed()' Remote Code Execution
CVE-2009-1669—webappsphp
The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers
28RISK
open ↗
Referência
CVE-2013-3563
CVE-2013-3563—
Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a de
50RISK
open ↗
Referência✓ VexDay Proof
Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow
CVE-2007-5067—remotewindows
Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long
60RISK
open ↗
Referência✓ VexDay Proof
bSpeak 1.10 - 'forumid' Blind SQL Injection
CVE-2009-1747—webappsphp
SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2009-3195
CVE-2009-3195—
Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2009-3196
CVE-2009-3196—
Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2013-2010
CVE-2013-2010—
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
60RISK
open ↗
Referência
CVE-2009-3203
CVE-2009-3203—
SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2009-3205
CVE-2009-3205—
SQL injection vulnerability in main.php in CBAuthority allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2015-1487
CVE-2015-1487—
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticat
50RISK
open ↗
Referência
CVE-2016-3316
CVE-2016-3316—
Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a craf
35RISK
open ↗
Referência
CVE-2020-11027
CVE-2020-11027MEDIUM
Password reset links invalidation issue in WordPress
38RISK
open ↗
Referência✓ VexDay Proof
jetAudio 7.x - ActiveX 'DownloadFromMusicStore()' Code Execution
CVE-2007-4983—remotewindows
Directory traversal vulnerability in the JetAudio.Interface.1 ActiveX control in JetFlExt.dll in jetAudio 7.0.3 Basic an
35RISK
open ↗
Referência
CVE-2018-7719
CVE-2018-7719—
Acrolinx Server before 5.2.5 on Windows allows Directory Traversal.
50RISK
open ↗
Referência
CVE-2019-15276
CVE-2019-15276HIGH
Cisco Wireless LAN Controller HTTP Parsing Engine Denial of Service Vulnerability
53RISK
open ↗
Referência
CVE-2023-6875
CVE-2023-6875CRITICAL
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
85RISK
open ↗
Referência
CVE-2016-0956
CVE-2016-0956—
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
35RISK
open ↗
Referência
CVE-2016-0956
CVE-2016-0956—
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
35RISK
open ↗
Referência
CVE-2013-5036
CVE-2013-5036—
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter t
50RISK
open ↗
← previouspage 520 / 748next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.