Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,837cataloged exploits
35,811CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,572GitHub PoC 14,291VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,549 exploits
Referência
CVE-2010-1947
CVE-2010-1947—
Directory traversal vulnerability in scr/soustab.php in openMairie Openregistrecil 1.02, when register_globals is enable
23RISK
open ↗
Referência
CVE-2014-9175
CVE-2014-9175—
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Referência
CVE-2014-9175
CVE-2014-9175—
SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
23RISK
open ↗
Referência
CVE-2012-1002
CVE-2012-1002—
SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
PHPizabi 0.848b C1 HFP1 - Remote Code Execution
CVE-2008-3239—webappsphp
Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP
23RISK
open ↗
Referência
CVE-2015-2090
CVE-2015-2090—
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISK
open ↗
Referência
CVE-2015-2090
CVE-2015-2090—
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 fo
23RISK
open ↗
Referência
CVE-2014-10013
CVE-2014-10013—
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to
23RISK
open ↗
Referência
CVE-2012-2276
CVE-2012-2276—
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote
23RISK
open ↗
Referência
CVE-2017-18195
CVE-2017-18195—
An issue was discovered in tools/conversations/view_ajax.php in Concrete5 before 8.3.0. An unauthenticated user can enum
28RISK
open ↗
Referência
CVE-2013-6793
CVE-2013-6793—
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote a
23RISK
open ↗
Referência
CVE-2015-4667
CVE-2015-4667—
Multiple hardcoded credentials in Xsuite 2.x.
28RISK
open ↗
Referência
CVE-2017-13869
CVE-2017-13869—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2018-10504
CVE-2018-10504—
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
23RISK
open ↗
Referência
CVE-2021-43140
CVE-2021-43140—
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
23RISK
open ↗
Referência
CVE-2015-4010
CVE-2015-4010—
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows rem
23RISK
open ↗
Referência
Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
CVE-2020-15261HIGHlocalwindows
Unquoted service path vulnerability on Veyon
46RISK
open ↗
Referência✓ VexDay Proof
PPMate PPMedia Class - ActiveX Control Buffer Overflow (PoC)
CVE-2008-3242—doswindows
Heap-based buffer overflow in the PPMedia Class ActiveX control in PPMPlayer.dll in PPMate 2.3.1.93 allows remote attack
28RISK
open ↗
Referência
CVE-2019-10846
CVE-2019-10846—
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and passw
23RISK
open ↗
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2016-1793
CVE-2016-1793—
AppleGraphicsDeviceControlClient in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged
23RISK
open ↗
Referência
CVE-2022-45639
CVE-2022-45639HIGH
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cra
41RISK
open ↗
Referência
CVE-2026-3485
CVE-2026-3485CRITICAL
D-Link DIR-868L SSDP Service sub_1BF84 os command injection
48RISK
open ↗
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Referência
CVE-2014-9142
CVE-2014-9142—
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers t
23RISK
open ↗
Referência
CVE-2015-2682
CVE-2015-2682—
Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via
28RISK
open ↗
Referência
CVE-2024-0204
CVE-2024-0204CRITICAL
Authentication Bypass in GoAnywhere MFT
85RISK
open ↗
Referência
CVE-2012-5875
CVE-2012-5875—
Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1
28RISK
open ↗
Referência
CVE-2019-12962
CVE-2019-12962—
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
38RISK
open ↗
← previouspage 584 / 752next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.