Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2017-11332
CVE-2017-11332—
The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (div
23RISK
open ↗
Referência
CVE-2009-0071
CVE-2009-0071—
Mozilla Firefox 3.0.5 and earlier 3.0.x versions, when designMode is enabled, allows remote attackers to cause a denial
23RISK
open ↗
Referência
CVE-2009-4089
CVE-2009-4089—
telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a mo
23RISK
open ↗
Referência✓ VexDay Proof
Pligg CMS 9.9.0 - 'editlink.php' SQL Injection
CVE-2008-1774—webappsphp
SQL injection vulnerability in editlink.php in Pligg 9.9.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2017-2504
CVE-2017-2504—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência✓ VexDay Proof
NewsOffice 1.1 - Remote File Inclusion
CVE-2008-1903—webappsphp
PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enab
35RISK
open ↗
Referência
CVE-2016-1595
CVE-2016-1595—
LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows rem
23RISK
open ↗
Referência
CVE-2024-4620
CVE-2024-4620CRITICAL
ArForms < 6.6 - Unauthenticated RCE
63RISK
open ↗
Referência
CVE-2026-19453
CVE-2026-19453HIGH
JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
41RISK
open ↗
Referência
CVE-2006-5190
CVE-2006-5190—
Multiple cross-site scripting (XSS) vulnerabilities in osCommerce 2.2 Milestone 2 Update 060817 allow remote attackers t
23RISK
open ↗
Referência
CVE-2026-91076
CVE-2026-91076MEDIUM
Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed
33RISK
open ↗
Referência
CVE-2026-91998
CVE-2026-91998CRITICAL
Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp
48RISK
open ↗
Referência✓ VexDay Proof
Mani Stats Reader 1.2 - 'ipath' Remote File Inclusion
CVE-2007-1299—webappsphp
PHP remote file inclusion vulnerability in index.php in Mani Stats Reader 1.2 and earlier allows remote attackers to exe
23RISK
open ↗
Referência
CVE-2010-5013
CVE-2010-5013—
SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows rem
23RISK
open ↗
Referência
CVE-2011-5165
CVE-2011-5165—
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗
Referência
CVE-2026-88927
CVE-2026-88927MEDIUM
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
33RISK
open ↗
Referência
CVE-2026-19251
CVE-2026-19251MEDIUM
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
33RISK
open ↗
Referência
CVE-2026-19116
CVE-2026-19116HIGH
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
41RISK
open ↗
Referência
CVE-2011-5165
CVE-2011-5165—
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗
Referência
CVE-2010-5014
CVE-2010-5014—
SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência✓ VexDay Proof
Sabros.us 1.75 - 'thumbnails.php' Remote File Disclosure
CVE-2008-1799—webappsphp
Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files vi
23RISK
open ↗
Referência
CVE-2016-10079
CVE-2016-10079—
SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long
23RISK
open ↗
Referência
CVE-2018-12589
CVE-2018-12589—
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in
28RISK
open ↗
Referência
CVE-2016-3717
CVE-2016-3717—
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
28RISK
open ↗
Referência
CVE-2017-5227
CVE-2017-5227—
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
23RISK
open ↗
Referência
CVE-2018-12589
CVE-2018-12589—
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in
28RISK
open ↗
Referência
CVE-2023-4113
CVE-2023-4113MEDIUM
PHP Jabbers Service Booking Script index.php cross site scripting
48RISK
open ↗
Referência
CVE-2019-12137
CVE-2019-12137—
Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substr
23RISK
open ↗
Referência✓ VexDay Proof
PHPAddressBook 2.11 - 'view.php' SQL Injection
CVE-2008-1847—webappsphp
SQL injection vulnerability in view.php in CoronaMatrix phpAddressBook 2.11 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2023-4116
CVE-2023-4116MEDIUM
PHP Jabbers Taxi Booking index.php cross site scripting
48RISK
open ↗
← previouspage 628 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.