Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2018-20010
CVE-2018-20010—
DomainMOD 4.11.01 has XSS via the assets/add/ssl-provider-account.php username field.
38RISK
open ↗
Referência
CVE-2026-11488
CVE-2026-11488MEDIUM
code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection
33RISK
open ↗
Referência
CVE-2026-84151
CVE-2026-84151LOW
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
28RISK
open ↗
Referência
CVE-2025-2749
CVE-2025-2749HIGHunder attack
Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE
71RISK
open ↗
Referência
CVE-2021-31962
CVE-2021-31962CRITICAL
Kerberos AppContainer Security Feature Bypass Vulnerability
48RISK
open ↗
Referência
CVE-2023-3849
CVE-2023-3849LOW
mooSocial mooDating URL find-a-match cross site scripting
43RISK
open ↗
Referência
CVE-2023-38836
CVE-2023-38836—
File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header t
60RISK
open ↗
Referência✓ VexDay Proof
CMS WebManager-Pro - Multiple SQL Injections
CVE-2008-2351—webappsphp
Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2012-4344
CVE-2012-4344—
Cross-site scripting (XSS) vulnerability in Ipswitch WhatsUp Gold 15.02 allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2016-8809
CVE-2016-8809—
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RISK
open ↗
Referência
CVE-2015-2843
CVE-2015-2843—
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute
50RISK
open ↗
Referência✓ VexDay Proof
PHP Classifieds Script - Remote Database Disclosure
CVE-2008-7080—webappsphp
Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which
23RISK
open ↗
Referência
CVE-2009-5093
CVE-2009-5093—
Directory traversal vulnerability in gastbuch.php in Gästebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2010-5032
CVE-2010-5032—
SQL injection vulnerability in the BF Quiz (com_bfquiztrial) component before 1.3.1 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2016-0171
CVE-2016-0171—
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
23RISK
open ↗
Referência
CVE-2026-11336
CVE-2026-11336MEDIUM
tittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization
33RISK
open ↗
Referência
CVE-2018-4083
CVE-2018-4083—
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Touch Bar S
23RISK
open ↗
Referência
CVE-2016-0171
CVE-2016-0171—
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
23RISK
open ↗
Referência
CVE-2019-1345
CVE-2019-1345—
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Window
23RISK
open ↗
Referência
CVE-2010-1271
CVE-2010-1271—
SQL injection vulnerability in showplugs.php in smartplugs 1.3 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2017-11331
CVE-2017-11331—
The wav_open function in oggenc/audio.c in Xiph.Org vorbis-tools 1.4.0 allows remote attackers to cause a denial of serv
23RISK
open ↗
Referência
CVE-2010-5035
CVE-2010-5035—
Cross-site scripting (XSS) vulnerability in search.php in iScripts eSwap 2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-5093
CVE-2014-5093—
Status2k does not remove the install directory allowing credential reset.
23RISK
open ↗
Referência✓ VexDay Proof
Jamroom 3.3.5 - Remote File Inclusion
CVE-2008-2886—webappsphp
PHP remote file inclusion vulnerability in include/plugins/jrBrowser/purchase.php in Jamroom 3.3.0 through 3.3.5, when r
23RISK
open ↗
Referência
CVE-2014-5349
CVE-2014-5349—
Stack-based buffer overflow in Baidu Spark Browser 26.5.9999.3511 allows remote attackers to cause a denial of service (
23RISK
open ↗
Referência
CVE-2017-15667
CVE-2017-15667—
In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafte
23RISK
open ↗
Referência
CVE-2019-19143
CVE-2019-19143—
TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi
23RISK
open ↗
Referência
Entrepreneur Dating Script 2.0.1 - 'marital' / 'gender' / 'country' / 'profileid' SQL Injection
CVE-2017-17648—webappsphp
Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid para
23RISK
open ↗
Referência
CVE-2020-18723
CVE-2020-18723—
Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code
23RISK
open ↗
Referência✓ VexDay Proof
Pluck CMS 4.5.2 - Multiple Local File Inclusions
CVE-2008-3851—webappsphp
Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute
23RISK
open ↗
← previouspage 580 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.