Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits

35,760CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecent popular risk

22,492 exploits

Referência

CVE-2018-0946

CVE-2018-0946—

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

35RISK

open ↗

Referência

CVE-2015-4632

CVE-2015-4632—

Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08

50RISK

open ↗

Referência

CVE-2015-4632

CVE-2015-4632—

Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08

50RISK

open ↗

Referência

CVE-2016-3288

CVE-2016-3288—

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet E

35RISK

open ↗

Referência

CVE-2014-5468

CVE-2014-5468—

A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf

50RISK

open ↗

Referência

CVE-2026-14749

CVE-2026-14749MEDIUM

mjperpinosa stumasy calculate.php eval code injection

33RISK

open ↗

Referência

CVE-2026-14748

CVE-2026-14748MEDIUM

AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery

33RISK

open ↗

Referência

CVE-2015-2097

CVE-2015-2097—

Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c

28RISK

open ↗

Referência

CVE-2015-2097

CVE-2015-2097—

Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c

28RISK

open ↗

Referência

CVE-2020-15261

CVE-2020-15261HIGH

Unquoted service path vulnerability on Veyon

46RISK

open ↗

Referência

CVE-2013-4625

CVE-2013-4625—

Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPr

43RISK

open ↗

Referência

CVE-2016-8020

CVE-2016-8020—

Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earl

28RISK

open ↗

Referência

CVE-2009-2254

CVE-2009-2254—

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows

28RISK

open ↗

Referência

CVE-2009-4816

CVE-2009-4816—

Directory traversal vulnerability in api/download_checker.php in MegaLab The Uploader 2.0 allows remote attackers to rea

23RISK

open ↗

Referência

CVE-2018-10123

CVE-2018-10123—

p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via reques

28RISK

open ↗

Referência

CVE-2015-5452

CVE-2015-5452—

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2014-8656

CVE-2014-8656—

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d

28RISK

open ↗

Referência

CVE-2014-8656

CVE-2014-8656—

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d

28RISK

open ↗

Referência

CVE-2010-2330

CVE-2010-2330—

Stack-based buffer overflow in iSharer File Sharing Wizard 1.5.0 allows remote attackers to cause a denial of service (c

28RISK

open ↗

Referência

CVE-2010-4259

CVE-2010-4259—

Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application cras

28RISK

open ↗

Referência

CVE-2018-9302

CVE-2018-9302—

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to r

23RISK

open ↗

Referência

CVE-2014-1907

CVE-2014-1907—

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for Wor

28RISK

open ↗

Referência

CVE-2015-6567

CVE-2015-6567—

Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/

28RISK

open ↗

Referência

CVE-2017-3006

CVE-2017-3006—

Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions durin

28RISK

open ↗

Referência

CVE-2013-6234

CVE-2013-6234—

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users

23RISK

open ↗

Referência

CVE-2022-38841

CVE-2022-38841HIGH

Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagn

46RISK

open ↗

Referência

CVE-2015-3205

CVE-2015-3205—

libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file,

28RISK

open ↗

Referência

CVE-2015-3205

CVE-2015-3205—

libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file,

28RISK

open ↗

Referência

CVE-2022-4681

CVE-2022-4681CRITICAL

Hide My WP < 6.2.9 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2017-20216

CVE-2017-20216CRITICAL

FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection

53RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.