Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,377 exploits

Referência

CVE-2020-2229

CVE-2020-2229—

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a sto

23RISK

open ↗

Referência

CVE-2026-11434

CVE-2026-11434MEDIUM

FluentCMS Blocks Plugin blocks cross site scripting

33RISK

open ↗

Referência

CVE-2025-34102

CVE-2025-34102CRITICAL

CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

63RISK

open ↗

Referência

CVE-2025-34102

CVE-2025-34102CRITICAL

CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

63RISK

open ↗

Referência

CVE-2025-34102

CVE-2025-34102CRITICAL

CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

63RISK

open ↗

Referência

CVE-2015-4040

CVE-2015-4040—

Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 t

23RISK

open ↗

Referência

CVE-2016-7387

CVE-2016-7387—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência✓ VexDay Proof

AllMyVisitors 0.4.0 - 'index.php' Remote File Inclusion

CVE-2007-0170—webappsphp

PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2012-4334

CVE-2012-4334—

The ConnectDDNS method in the (1) STWConfigNVR 1.1.13.15 and (2) STWConfig 1.1.14.13 ActiveX controls in Samsung NET-i v

23RISK

open ↗

Referência

CVE-2014-6308

CVE-2014-6308—

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. (dot

43RISK

open ↗

Referência

CVE-2017-2454

CVE-2017-2454—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef

23RISK

open ↗

Referência

Campcodes Online Matrimonial Website System v3.3 - Code Execution via malicious SVG file upload

CVE-2023-39115—webappsphp

install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG docum

23RISK

open ↗

Referência✓ VexDay Proof

Prediction Football 1.x - 'matchid' SQL Injection

CVE-2008-1732—webappsphp

SQL injection vulnerability in showpredictionsformatch.php in Prediction Football 1.x allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

PHP Photo Gallery 1.0 - 'photo_id' SQL Injection

CVE-2008-1875—webappsphp

SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote

23RISK

open ↗

Referência

CVE-2011-5006

CVE-2011-5006—

Stack-based buffer overflow in QQPlayer 3.2.845 allows remote attackers to execute arbitrary code via a crafted PnSize v

23RISK

open ↗

Referência

CVE-2010-2329

CVE-2010-2329—

Buffer overflow in Rosoft Audio Converter 4.4.4 allows remote attackers to execute arbitrary code via a long playlist en

23RISK

open ↗

Referência

CVE-2016-7644

CVE-2016-7644—

An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchO

23RISK

open ↗

Referência

CVE-2010-2329

CVE-2010-2329—

Buffer overflow in Rosoft Audio Converter 4.4.4 allows remote attackers to execute arbitrary code via a long playlist en

23RISK

open ↗

Referência✓ VexDay Proof

Esqlanelapse Software Project 2.6.2 - Insecure Cookie Handling

CVE-2008-7019—webappsphp

Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enomb

23RISK

open ↗

Referência

CVE-2009-4679

CVE-2009-4679—

Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows

38RISK

open ↗

Referência

CVE-2014-8657

CVE-2014-8657—

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH allows r

23RISK

open ↗

Referência

CVE-2018-7474

CVE-2018-7474—

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on

23RISK

open ↗

Referência

CVE-2018-10577

CVE-2018-10577—

An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w

23RISK

open ↗

Referência

CVE-2016-6504

CVE-2016-6504—

epan/dissectors/packet-ncp2222.inc in the NDS dissector in Wireshark 1.12.x before 1.12.13 does not properly maintain a

23RISK

open ↗

Referência✓ VexDay Proof

webdesproxy 0.0.1 - GET Remote Buffer Overflow

CVE-2007-2668—remotewindows

Buffer overflow in webdesproxy 0.0.1 allows remote attackers to execute arbitrary code via a long URL, possibly involvin

23RISK

open ↗

Referência

CVE-2010-0694

CVE-2010-0694—

SQL injection vulnerability in the PerchaGallery (com_perchagallery) component before 1.5b for Joomla! allows remote att

23RISK

open ↗

Referência

CVE-2011-5111

CVE-2011-5111—

Multiple SQL injection vulnerabilities in Kajian Website CMS Balitbang 3.x allow remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2009-3443

CVE-2009-3443—

SQL injection vulnerability in the Fastball (com_fastball) component 1.1.0 through 1.2 for Joomla! allows remote attacke

23RISK

open ↗

Referência

CVE-2017-11332

CVE-2017-11332—

The startread function in wav.c in Sound eXchange (SoX) 14.4.2 allows remote attackers to cause a denial of service (div

23RISK

open ↗

Referência

CVE-2009-0071

CVE-2009-0071—

Mozilla Firefox 3.0.5 and earlier 3.0.x versions, when designMode is enabled, allows remote attackers to cause a denial

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.