Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,426 exploits
Referência
CVE-2019-19245
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[use
23RISK
open ↗Referência
CVE-2021-3294
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a co
23RISK
open ↗Referência
CVE-2022-45717
IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName param
48RISK
open ↗Referência
CVE-2022-45709
IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLev
48RISK
open ↗Referência
CVE-2017-13865
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗Referência
CVE-2017-2353
An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the "Bluetooth"
23RISK
open ↗Referência✓ VexDay Proof
QuickTalk forum 1.3 - 'lang' Local File Inclusion
Multiple directory traversal vulnerabilities in QuickTalk forum 1.3 allow remote attackers to include and execute arbitr
23RISK
open ↗Referência
LightCMS 1.3.4 - 'exclusive' Stored XSS
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Tit
23RISK
open ↗Referência✓ VexDay Proof
Microsoft Visual FoxPro 6.0 - 'FPOLE.OCX' Arbitrary Command Execution
Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote a
28RISK
open ↗Referência
CVE-2014-4034
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Referência
CVE-2016-2539
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
BBlog 0.7.6 - 'mod' SQL Injection
SQL injection vulnerability in bblog_plugins/builtin.help.php in bBlog 0.7.6 allows remote attackers to execute arbitrar
23RISK
open ↗Referência
CVE-2008-4447
Cross-site scripting (XSS) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote atta
23RISK
open ↗Referência
CVE-2011-5284
Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothw
23RISK
open ↗Referência
CVE-2008-4458
SQL injection vulnerability in listings.php in E-Php B2B Trading Marketplace Script allows remote attackers to execute a
23RISK
open ↗Referência✓ VexDay Proof
EZ Publish < 3.9.5/3.10.1/4.0.1 - Privilege Escalation
The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1
23RISK
open ↗Referência✓ VexDay Proof
Mini-stream Ripper 3.0.1.1 - '.m3u' Universal Stack Overflow
Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long U
23RISK
open ↗Referência
CVE-2009-3666
Cross-site scripting (XSS) vulnerability in index.php in Nullam Blog 0.1.2 allows remote attackers to inject arbitrary w
23RISK
open ↗Referência
CVE-2018-5971
SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array paramet
23RISK
open ↗Referência
CVE-2015-1054
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to in
23RISK
open ↗Referência
CVE-2015-1054
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to in
23RISK
open ↗Referência
CVE-2017-13253
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. Thi
23RISK
open ↗Referência
CVE-2017-9130
The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to caus
23RISK
open ↗Referência
CVE-2010-3205
PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2026-79995
User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR
33RISK
open ↗Referência
CVE-2010-4998
PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote
23RISK
open ↗Referência✓ VexDay Proof
Grestul 1.2 - Remote Add Administrator Account
admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authenticati
23RISK
open ↗Referência✓ VexDay Proof
Sendcard 3.4.1 - Local File Inclusion / Remote Code Execution
Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to include and e
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.