Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,813cataloged exploits

35,788CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

22,549 exploits

Referência

CVE-2009-1329

CVE-2009-1329—

Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary c

23RISK

open ↗

Referência

phpList 3.5.0 - Authentication Bypass

CVE-2020-8547—webappsphp

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which m

23RISK

open ↗

Referência

CVE-2023-0232

CVE-2023-0232CRITICAL

ShopLentor < 2.5.4 - PHP Object Injection

48RISK

open ↗

Referência

CVE-2014-7226

CVE-2014-7226—

The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2014-7226

CVE-2014-7226—

The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2021-34684

CVE-2021-34684CRITICAL

Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries o

48RISK

open ↗

Referência

CVE-2017-5496

CVE-2017-5496—

Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.

23RISK

open ↗

Referência

CVE-2017-5496

CVE-2017-5496—

Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash.

23RISK

open ↗

Referência

CVE-2010-0974

CVE-2010-0974—

Multiple SQL injection vulnerabilities in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2010-0974

CVE-2010-0974—

Multiple SQL injection vulnerabilities in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the

23RISK

open ↗

Referência

CVE-2013-7280

CVE-2013-7280—

Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of servic

23RISK

open ↗

Referência

CVE-2013-7280

CVE-2013-7280—

Buffer overflow in HansoTools Hanso Player 2.1.0, 2.5.0, and earlier allows remote attackers to cause a denial of servic

23RISK

open ↗

Referência

CVE-2021-28142

CVE-2021-28142—

CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."

23RISK

open ↗

Referência

CVE-2017-16780

CVE-2017-16780—

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration fi

23RISK

open ↗

Referência

CVE-2010-4709

CVE-2010-4709—

Heap-based buffer overflow in Automated Solutions Modbus/TCP Master OPC Server before 3.0.2 allows remote attackers to c

28RISK

open ↗

Referência

CVE-2019-19740

CVE-2019-19740—

Octeth Oempro 4.7 and 4.8 allow SQL injection. The parameter CampaignID in Campaign.Get is vulnerable.

23RISK

open ↗

Referência

CVE-2009-4863

CVE-2009-4863—

Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a lo

23RISK

open ↗

Referência

CVE-2018-12292

CVE-2018-12292—

A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3.

23RISK

open ↗

Referência

CVE-2017-2371

CVE-2017-2371—

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" compon

23RISK

open ↗

Referência

CVE-2021-24750

CVE-2021-24750—

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

50RISK

open ↗

Referência

CVE-2023-33131

CVE-2023-33131HIGH

Microsoft Outlook Remote Code Execution Vulnerability

41RISK

open ↗

Referência

CVE-2020-12352

CVE-2020-12352—

Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adja

23RISK

open ↗

Referência

CVE-2020-12352

CVE-2020-12352—

Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adja

23RISK

open ↗

Referência

CVE-2020-8899

CVE-2020-8899CRITICAL

Memory corruption in Quram library when decoding qmg can lead to RCE

48RISK

open ↗

Referência

CVE-2011-0502

CVE-2011-0502—

Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attack

23RISK

open ↗

Referência

CVE-2023-53941

CVE-2023-53941CRITICAL

EasyPHP Webserver 14.1 Remote Code Execution

48RISK

open ↗

Referência

CVE-2025-14708

CVE-2025-14708CRITICAL

Shiguangwu sgwbox N3 WIREDCFGGET http_eshell_server buffer overflow

48RISK

open ↗

Referência

CVE-2018-4193

CVE-2018-4193—

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Windows Ser

23RISK

open ↗

Referência

CVE-2017-8869

CVE-2017-8869—

Buffer overflow in MediaCoder 0.8.48.5888 allows remote attackers to execute arbitrary code via a crafted .m3u file.

43RISK

open ↗

Referência✓ VexDay Proof

PHPFK 7.03 - 'page_bottom.php' Local File Inclusion

CVE-2009-2112—webappsphp

Directory traversal vulnerability in include/page_bottom.php in phpFK 7.03 allows remote attackers to include and execut

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.