Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,573 exploits
Referência
CVE-2010-2314
CVE-2010-2314—
PHP remote file inclusion vulnerability in nucleus/plugins/NP_Twitter.php in the NP_Twitter Plugin 0.8 and 0.9 for Nucle
23RISK
open ↗
Referência
CVE-2010-1305
CVE-2010-1305—
Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot
43RISK
open ↗
Referência
CVE-2017-2515
CVE-2017-2515—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2011-2544
CVE-2011-2544—
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier a
23RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2015-8356
CVE-2015-8356—
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u
23RISK
open ↗
Referência
CVE-2023-0963
CVE-2023-0963HIGH
SourceCodester Music Gallery Site POST Request Users.php access control
41RISK
open ↗
Referência
CVE-2011-0887
CVE-2011-0887—
The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses pred
23RISK
open ↗
Referência
CVE-2014-1843
CVE-2014-1843—
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISK
open ↗
Referência
CVE-2017-6999
CVE-2017-6999—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência
CVE-2017-6997
CVE-2017-6997—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência✓ VexDay Proof
Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite
CVE-2007-2644—remotewindows
A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrar
23RISK
open ↗
Referência
CVE-2010-1471
CVE-2010-1471—
Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attacke
43RISK
open ↗
Referência
CVE-2026-15236
CVE-2026-15236HIGH
Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure
41RISK
open ↗
Referência
CVE-2014-6619
CVE-2014-6619—
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Referência
CVE-2014-6619
CVE-2014-6619—
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Referência
CVE-2011-3713
CVE-2011-3713—
cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the
23RISK
open ↗
Referência
CVE-2019-8937
CVE-2019-8937—
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗
Referência
CVE-2019-8937
CVE-2019-8937—
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2006-6566
CVE-2006-6566—
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-7368
CVE-2013-7368—
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
← previouspage 598 / 753next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.