Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2015-7944
CVE-2015-7944—
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11
28RISK
open ↗
Referência✓ VexDay Proof
Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure
CVE-2007-4820—webappsphp
Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitra
23RISK
open ↗
Referência✓ VexDay Proof
PHP Auto Listings - 'pg' SQL Injection
CVE-2008-6226—webappsphp
SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic_quotes_gpc is disabled,
23RISK
open ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RISK
open ↗
Referência
CVE-2018-1218
CVE-2018-1218—
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the '
28RISK
open ↗
Referência
CVE-2018-4237
CVE-2018-4237—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RISK
open ↗
Referência
CVE-2015-3088
CVE-2015-3088—
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows an
35RISK
open ↗
Referência
CVE-2017-10246
CVE-2017-10246—
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Suppo
28RISK
open ↗
Referência
CVE-2019-1149
CVE-2019-1149HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RISK
open ↗
Referência
CVE-2026-90687
CVE-2026-90687MEDIUM
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
33RISK
open ↗
Referência✓ VexDay Proof
PHP League 0.82 - 'classement.php' SQL Injection
CVE-2006-5676—webappsasp
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to
23RISK
open ↗
Referência
CVE-2019-3810
CVE-2019-3810MEDIUM
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported vers
38RISK
open ↗
Referência
CVE-2020-5726
CVE-2020-5726—
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem
23RISK
open ↗
Referência✓ VexDay Proof
PHP 4.4.6 - 'crack_opendict()' Local Buffer Overflow
CVE-2007-1401—localwindows
Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allo
23RISK
open ↗
Referência
CVE-2026-90686
CVE-2026-90686MEDIUM
GPAC MP4Box loader_bt.c gf_bt_report memory corruption
33RISK
open ↗
Referência
CVE-2026-90685
CVE-2026-90685LOW
GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
28RISK
open ↗
Referência
CVE-2013-3526
CVE-2013-3526—
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earli
43RISK
open ↗
Referência✓ VexDay Proof
PHP Webquest 2.5 - 'id_actividad' SQL Injection
CVE-2007-4920—webappsphp
SQL injection vulnerability in soporte_derecha_w.php in PHP Webquest 2.5 and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2013-6127
CVE-2013-6127—
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53
28RISK
open ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RISK
open ↗
Referência
CVE-2017-11152
CVE-2017-11152—
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
28RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Software - 'id' SQL Injection
CVE-2008-6237—webappsphp
SQL injection vulnerability in software-description.php in Scripts For Sites (SFS) Hotscripts-like Site allows remote at
23RISK
open ↗
Referência
CVE-2018-6383
CVE-2018-6383—
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but
28RISK
open ↗
Referência
CVE-2019-7391
CVE-2019-7391—
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
28RISK
open ↗
Referência
CVE-2019-7391
CVE-2019-7391—
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
28RISK
open ↗
Referência
CVE-2026-13556
CVE-2026-13556MEDIUM
itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting
33RISK
open ↗
Referência
CVE-2010-1352
CVE-2010-1352—
Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2026-13555
CVE-2026-13555MEDIUM
itsourcecode Online Hotel Management System controller.php add sql injection
33RISK
open ↗
Referência
CVE-2014-5465
CVE-2014-5465—
Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress
28RISK
open ↗
Referência✓ VexDay Proof
T.G.S. CMS 0.1.7 - 'logout.php' SQL Injection
CVE-2006-5732—webappsphp
SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
← previouspage 630 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.