Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
22,492 exploits
Referência
CVE-2026-14753
CVE-2026-14753MEDIUM
mjperpinosa stumasy Note Handler/Assignment notes authorization
33RISK
open ↗
Referência
CVE-2026-14752
CVE-2026-14752MEDIUM
mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting
33RISK
open ↗
Referência
CVE-2026-14751
CVE-2026-14751MEDIUM
mjperpinosa stumasy search_scratch_data.php search_scratch_data sql injection
33RISK
open ↗
Referência
CVE-2026-14750
CVE-2026-14750MEDIUM
mjperpinosa stumasy accessing_dictionary_authorization.php accessing_dictionary_authorization sql injection
33RISK
open ↗
Referência
Sahi Pro 8.0.0 - Remote Command Execution
CVE-2019-13597—webappsjava
_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts vi
28RISK
open ↗
Referência
Core FTP Server FTP / SFTP Server v2 Build 674 - 'SIZE' Directory Traversal
CVE-2019-9648—doswindows
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exis
28RISK
open ↗
Referência
CVE-2009-4696
CVE-2009-4696—
SQL injection vulnerability in index.php in RadNICS Gold 5 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2016-5679
CVE-2016-5679—
cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticat
28RISK
open ↗
Referência
CVE-2018-9842
CVE-2018-9842—
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISK
open ↗
Referência
CVE-2018-9842
CVE-2018-9842—
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISK
open ↗
Referência
CVE-2018-9842
CVE-2018-9842—
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISK
open ↗
Referência
CVE-2003-0264
CVE-2003-0264—
Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg
60RISK
open ↗
Referência
CVE-2012-5106
CVE-2012-5106—
Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via
28RISK
open ↗
Referência
CVE-2019-4013
CVE-2019-4013CRITICAL
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr
53RISK
open ↗
Referência
CVE-2016-9838
CVE-2016-9838—
An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of
28RISK
open ↗
Referência
CVE-2019-6445
CVE-2019-6445—
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd
28RISK
open ↗
Referência
CVE-2010-1431
CVE-2010-1431—
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2017-9080
CVE-2017-9080—
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile
50RISK
open ↗
Referência
CVE-2015-2068
CVE-2015-2068—
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a
43RISK
open ↗
Referência
CVE-2010-1466
CVE-2010-1466—
Directory traversal vulnerability in scr/soustab.php in openUrgence Vaccin 1.03 allows remote attackers to read arbitrar
23RISK
open ↗
Referência
CVE-2018-1218
CVE-2018-1218—
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the '
28RISK
open ↗
Referência
CVE-2015-3088
CVE-2015-3088—
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows an
35RISK
open ↗
Referência
CVE-2016-3473
CVE-2016-3473—
Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0,
28RISK
open ↗
Referência
CVE-2013-3526
CVE-2013-3526—
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earli
43RISK
open ↗
Referência
CVE-2020-5726
CVE-2020-5726—
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem
23RISK
open ↗
Referência
CVE-2017-10246
CVE-2017-10246—
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Suppo
28RISK
open ↗
Referência
CVE-2021-31933
CVE-2021-31933HIGH
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a paramete
46RISK
open ↗
Referência
CVE-2018-4237
CVE-2018-4237—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RISK
open ↗
Referência
CVE-2013-6127
CVE-2013-6127—
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53
28RISK
open ↗
Referência
CVE-2017-11152
CVE-2017-11152—
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
28RISK
open ↗
← previouspage 527 / 750next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.