Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,573 exploits
Referência
CVE-2017-0103
CVE-2017-0103—
The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 201
23RISK
open ↗
Referência
CVE-2018-1513
CVE-2018-1513MEDIUM
IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerabili
33RISK
open ↗
Referência
CVE-2013-0126
CVE-2013-0126—
Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I rout
23RISK
open ↗
Referência
CVE-2023-36163
CVE-2023-36163—
Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code
23RISK
open ↗
Referência✓ VexDay Proof
openEngine 2.0 beta2 - Remote File Inclusion
CVE-2008-4719—webappsphp
PHP remote file inclusion vulnerability in cms/classes/openengine/filepool.php in openEngine 2.0 beta2, when register_gl
23RISK
open ↗
Referência
CVE-2012-1124
CVE-2012-1124—
SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Motorola Timbuktu Pro 8.6.5/8.7 - Directory Traversal / Log Injection
CVE-2008-1118—remotewindows
Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging informat
23RISK
open ↗
Referência
CVE-2010-4300
CVE-2010-4300—
Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector i
28RISK
open ↗
Referência
CVE-2012-1189
CVE-2012-1189—
Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3
23RISK
open ↗
Referência
CVE-2009-2397
CVE-2009-2397—
Directory traversal vulnerability in download.php in Audio Article Directory allows remote attackers to read arbitrary f
23RISK
open ↗
Referência
CVE-2026-15715
CVE-2026-15715MEDIUM
SourceCodester Class and Exam Timetabling System exam.php cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
gelato CMS 0.95 - 'img' Remote File Disclosure
CVE-2008-3675—webappsphp
Directory traversal vulnerability in classes/imgsize.php in Gelato 0.95 allows remote attackers to read arbitrary files
23RISK
open ↗
Referência
CVE-2014-4114
CVE-2014-4114HIGHunder attack
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RISK
open ↗
Referência
CVE-2009-3425
CVE-2009-3425—
Directory traversal vulnerability in includes/inc.thcms_admin_dirtree.php in MaxCMS 3.11.20b allows remote attackers to
23RISK
open ↗
Referência
CVE-2006-4631
CVE-2006-4631—
Direct static code injection vulnerability in admin/save_opt.php in SoftBB 0.1, and possibly earlier, allows remote auth
23RISK
open ↗
Referência
CVE-2012-10041
CVE-2012-10041CRITICAL
WAN Emulator v2.3 Command Execution
63RISK
open ↗
Referência
CVE-2012-10041
CVE-2012-10041CRITICAL
WAN Emulator v2.3 Command Execution
63RISK
open ↗
Referência
CVE-2017-7004
CVE-2017-7004—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The
23RISK
open ↗
Referência
CVE-2018-0882
CVE-2018-0882—
The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el
23RISK
open ↗
Referência✓ VexDay Proof
Falt4 CMS RC4 - 'FCKeditor' Arbitrary File Upload
CVE-2008-6178—webappsphp
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2
23RISK
open ↗
Referência✓ VexDay Proof
Newswriter SW 1.42 - 'editfunc.inc.php' File Inclusion
CVE-2006-5102—webappsphp
PHP remote file inclusion vulnerability in include/editfunc.inc.php in Sebastian Baumann and Philipp Wolfer Newswriter S
23RISK
open ↗
Referência✓ VexDay Proof
Eudora 7.1 - SMTP ResponseRemote Remote Buffer Overflow
CVE-2007-2770—remotewindows
Stack-based buffer overflow in Eudora 7.1 allows user-assisted, remote SMTP servers to execute arbitrary code via a long
23RISK
open ↗
Referência✓ VexDay Proof
OZJournals 2.1.1 - 'id' File Disclosure
CVE-2008-0435—webappsphp
Directory traversal vulnerability in index.php in OZJournals 2.1.1 allows remote attackers to read portions of arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
MG-SOFT Net Inspector 6.5.0.828 - Multiple Vulnerabilities
CVE-2008-1400—remotewindows
Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earl
23RISK
open ↗
Referência
CVE-2020-27422
CVE-2020-27422—
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an a
23RISK
open ↗
Referência
CVE-2014-2533
CVE-2014-2533—
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
38RISK
open ↗
Referência
CVE-2014-2533
CVE-2014-2533—
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
38RISK
open ↗
Referência
CVE-2009-4886
CVE-2009-4886—
Multiple directory traversal vulnerabilities in phpCommunity 2 2.1.8 allow remote attackers to read arbitrary files via
23RISK
open ↗
Referência
CVE-2009-4456
CVE-2009-4456—
SQL injection vulnerability in news_detail.php in Green Desktiny 2.3.1, and possibly earlier versions, allows remote att
23RISK
open ↗
Referência
CVE-2012-1935
CVE-2012-1935—
Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote att
23RISK
open ↗
← previouspage 600 / 753next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.