Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,836cataloged exploits
35,811CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,572GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,549 exploits
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2022-45639
CVE-2022-45639HIGH
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cra
41RISK
open ↗
Referência
CVE-2026-3485
CVE-2026-3485CRITICAL
D-Link DIR-868L SSDP Service sub_1BF84 os command injection
48RISK
open ↗
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2024-0204
CVE-2024-0204CRITICAL
Authentication Bypass in GoAnywhere MFT
85RISK
open ↗
Referência
CVE-2012-5875
CVE-2012-5875—
Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1
28RISK
open ↗
Referência
CVE-2019-12962
CVE-2019-12962—
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
38RISK
open ↗
Referência
CVE-2017-11661
CVE-2017-11661—
The _WM_SetupMidiEvent function in internal_midi.c:2318 in WildMIDI 0.4.2 can cause a denial of service (invalid memory
28RISK
open ↗
Referência
CVE-2013-3075
CVE-2013-3075—
Multiple buffer overflows in ActUWzd.dll 1.0.0.1 in Mitsubishi MX Component 3, as distributed in Citect CitectFacilities
28RISK
open ↗
Referência
CVE-2012-0781
CVE-2012-0781—
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer derefere
28RISK
open ↗
Referência
CVE-2018-19125
CVE-2018-19125—
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory.
28RISK
open ↗
Referência
CVE-2019-1674
CVE-2019-1674HIGH
Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability
46RISK
open ↗
Referência
CVE-2017-20216
CVE-2017-20216CRITICAL
FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection
53RISK
open ↗
Referência
CVE-2014-9349
CVE-2014-9349—
Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2026-16064
CVE-2026-16064MEDIUM
Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event
33RISK
open ↗
Referência
CVE-2010-1341
CVE-2010-1341—
SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2018-12520
CVE-2018-12520—
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seede
28RISK
open ↗
Referência
CVE-2012-0407
CVE-2012-0407—
Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote att
23RISK
open ↗
Referência
CVE-2015-5999
CVE-2015-5999—
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2
23RISK
open ↗
Referência
CVE-2015-5999
CVE-2015-5999—
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2
23RISK
open ↗
Referência
CVE-2026-16063
CVE-2026-16063MEDIUM
Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content
33RISK
open ↗
Referência
CVE-2019-1010124
CVE-2019-1010124—
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to
23RISK
open ↗
Referência
CVE-2018-17376
CVE-2018-17376—
SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter
23RISK
open ↗
Referência
CVE-2018-6947
CVE-2018-6947—
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
23RISK
open ↗
Referência
CVE-2018-6947
CVE-2018-6947—
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoM
23RISK
open ↗
Referência✓ VexDay Proof
Lms 1.8.9 - Vala Remote File Inclusion
CVE-2007-1643—webappsphp
Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote at
28RISK
open ↗
Referência✓ VexDay Proof
Focus/SIS 1.0/2.2 - Remote File Inclusion
CVE-2007-4806—webappsphp
PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote a
23RISK
open ↗
← previouspage 582 / 752next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.