Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits
40,695CVEs with public exploitation
24,696lab-tested
AllReferência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
26,327 exploits
Referência
CVE-2010-1306
CVE-2010-1306—
Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote at
43RISK
open ↗
Referência✓ VexDay Proof
AtomixMP3 2.3 - '.pls' Local Buffer Overflow
CVE-2007-4803—localwindows
Buffer overflow in AtomixMP3 2.3 allows user-assisted remote attackers to execute arbitrary code via long strings in fil
23RISK
open ↗
Referência
CVE-2020-5377
CVE-2020-5377CRITICAL
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.
60RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2026-15034
CVE-2026-15034MEDIUM
flask-dashboard Flask-MonitoringDashboard cross-site request forgery
33RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2014-4158
CVE-2014-4158—
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISK
open ↗
Referência
CVE-2023-36812
CVE-2023-36812CRITICAL
Remote Code Execution in OpenTSDB
68RISK
open ↗
Referência
EasyNas 1.1.0 - OS Command Injection
CVE-2023-0830MEDIUMremotehardware
EasyNAS backup.pl system os command injection
38RISK
open ↗
Referência✓ VexDay Proof
Fuzzylime CMS 3.0 - Local File Inclusion
CVE-2007-4805—webappsphp
Directory traversal vulnerability in getgalldata.php in fuzzylime (cms) 3.0 and earlier allows remote attackers to inclu
23RISK
open ↗
Referência✓ VexDay Proof
Mooseguy Blog System 1.0 - 'month' SQL Injection
CVE-2008-0424—webappsphp
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2026-19857
CVE-2026-19857MEDIUM
Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token
33RISK
open ↗
Referência✓ VexDay Proof
ABC Advertise 1.0 - Admin Password Disclosure
CVE-2009-1550—webappsphp
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to
23RISK
open ↗
Referência
CVE-2011-0917
CVE-2011-0917—
Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in
28RISK
open ↗
Referência
CVE-2013-3893
CVE-2013-3893HIGHunder attack
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throug
100RISK
open ↗
Referência
CVE-2026-14797
CVE-2026-14797MEDIUM
CodeAstro Apartment Visitor Management System edit-apartment.php sql injection
33RISK
open ↗
Referência
CVE-2015-7246
CVE-2015-7246—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RISK
open ↗
Referência
CVE-2013-3928
CVE-2013-3928—
Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta
50RISK
open ↗
Referência
CVE-2018-9842
CVE-2018-9842—
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISK
open ↗
Referência
CVE-2016-9838
CVE-2016-9838—
An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of
28RISK
open ↗
Referência
CVE-2018-9842
CVE-2018-9842—
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISK
open ↗
Referência
CVE-2017-9080
CVE-2017-9080—
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile
50RISK
open ↗
Referência
CVE-2018-9842
CVE-2018-9842—
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
28RISK
open ↗
Referência
CVE-2019-4013
CVE-2019-4013CRITICAL
IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr
53RISK
open ↗
Referência
CVE-2003-0264
CVE-2003-0264—
Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg
60RISK
open ↗
Referência✓ VexDay Proof
SCart 2.0 - 'page' Remote Code Execution
CVE-2006-7012—webappsphp
scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parame
23RISK
open ↗
Referência
CVE-2019-6445
CVE-2019-6445—
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd
28RISK
open ↗
Referência
CVE-2010-1305
CVE-2010-1305—
Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot
43RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual Studio 6.0 - 'VBTOVSI.dll 1.0.0.0' File Overwrite
CVE-2007-4890—remotewindows
Absolute directory traversal vulnerability in a certain ActiveX control in the VB To VSI Support Library (VBTOVSI.DLL) 1
28RISK
open ↗
Referência
CVE-2010-1307
CVE-2010-1307—
Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers
43RISK
open ↗
← previouspage 643 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.