Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2021-36260
CVE-2021-36260CRITICALunder attack
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗
Referência
CVE-2026-10873
CVE-2026-10873HIGH
Shibby Tomato Web UI rstats rstats_path os command injection
41RISK
open ↗
Referência
CVE-2018-1111
CVE-2018-1111HIGH
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in
78RISK
open ↗
Referência✓ VexDay Proof
PhotoKorn Gallery 1.543 - 'pic' SQL Injection
CVE-2008-0614—webappsphp
SQL injection vulnerability in index.php in Photokorn Gallery 1.543 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
NERO Media Player 1.4.0.35b - '.m3u' File Buffer Overflow (PoC)
CVE-2008-0619—doswindows
Buffer overflow in NeroMediaPlayer.exe in Nero Media Player 1.4.0.35 and earlier allows remote attackers to execute arbi
28RISK
open ↗
Referência
CVE-2026-82599
CVE-2026-82599MEDIUM
SeaCMS Avatar Upload member.php unlink path traversal
33RISK
open ↗
Referência
CVE-2026-10567
CVE-2026-10567MEDIUM
1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
33RISK
open ↗
Referência
CVE-2018-25434
CVE-2018-25434HIGH
WP AutoSuggest 0.24 SQL Injection via autosuggest.php
41RISK
open ↗
Referência
CVE-2018-25433
CVE-2018-25433HIGH
Joomla JE Photo Gallery 1.1 SQL Injection via categoryid
41RISK
open ↗
Referência
CVE-2018-25432
CVE-2018-25432HIGH
Arm Whois 3.11 Buffer Overflow via ASLR Bypass
41RISK
open ↗
Referência
CVE-2020-8617
CVE-2020-8617HIGH
A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c
78RISK
open ↗
Referência
CVE-2026-10273
CVE-2026-10273MEDIUM
php-censor Webhook Endpoint GitBuild.php os command injection
33RISK
open ↗
Referência✓ VexDay Proof
The Everything Development System Pre-1.0 - SQL Injection
CVE-2008-0675—webappsphp
SQL injection vulnerability in cms/index.pl in The Everything Development Engine in The Everything Development System Pr
23RISK
open ↗
Referência✓ VexDay Proof
BlogPHP 2 - 'id' Cross-Site Scripting / SQL Injection
CVE-2008-0679—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência
CVE-2018-11510
CVE-2018-11510—
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
35RISK
open ↗
Referência
CVE-2018-11510
CVE-2018-11510—
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
35RISK
open ↗
Referência
CVE-2021-40868
CVE-2021-40868—
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
38RISK
open ↗
Referência
CVE-2021-40868
CVE-2021-40868—
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
38RISK
open ↗
Referência
Payara Micro Community 5.2021.6 - Directory Traversal
CVE-2021-41381—webappsmultiple
Payara Micro Community 5.2021.6 and below allows Directory Traversal.
50RISK
open ↗
Referência
CVE-2026-86060
CVE-2026-86060CRITICALunder attack
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke Modules Okul 1.0 - 'okulid' SQL Injection
CVE-2008-0881—webappsphp
SQL injection vulnerability in modules.php in the Okul 1.0 module for PHP-Nuke allows remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2018-11526
CVE-2018-11526—
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
23RISK
open ↗
Referência✓ VexDay Proof
Globsy 1.0 - 'file' Remote File Disclosure
CVE-2008-0905—webappsphp
Directory traversal vulnerability in globsy_edit.php in Globsy 1.0 allows remote attackers to read arbitrary files via a
23RISK
open ↗
Referência
CVE-2018-11529
CVE-2018-11529—
VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arb
50RISK
open ↗
Referência
CVE-2026-108693
CVE-2026-108693HIGH
ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
41RISK
open ↗
Referência
CVE-2021-21972
CVE-2021-21972CRITICALunder attackransomware
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗
Referência
CVE-2026-90504
CVE-2026-90504MEDIUM
vvbbnn00 WARP-Clash-API authorized missing authentication
33RISK
open ↗
Referência
CVE-2019-0211
CVE-2019-0211HIGHunder attack
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privilege
83RISK
open ↗
Referência✓ VexDay Proof
Eurologon CMS - 'files.php' Arbitrary File Download
CVE-2007-6185—webappsphp
Directory traversal vulnerability in users/files.php in Eurologon CMS allows remote attackers to read arbitrary files vi
23RISK
open ↗
Referência✓ VexDay Proof
IP Reg 0.4 - Multiple SQL Injections
CVE-2008-4606—webappsphp
Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
← previouspage 533 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.