Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2015-4631
CVE-2015-4631—
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before
23RISK
open ↗
Referência
CVE-2018-20418
CVE-2018-20418—
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.
23RISK
open ↗
Referência
CVE-2018-11091
CVE-2018-11091CRITICAL
An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. I
48RISK
open ↗
Referência
CVE-2015-7346
CVE-2015-7346—
SQL injection vulnerability in ZCMS 1.1.
23RISK
open ↗
Referência
CVE-2016-3643
CVE-2016-3643HIGHunder attack
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguratio
71RISK
open ↗
Referência
CVE-2014-9179
CVE-2014-9179—
Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authe
23RISK
open ↗
Referência
CVE-2014-9558
CVE-2014-9558—
Multiple SQL injection vulnerabilities in SmartCMS v.2.
23RISK
open ↗
Referência
CVE-2017-6896
CVE-2017-6896—
Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from
23RISK
open ↗
Referência✓ VexDay Proof
snap - seccomp BBlacklist for TIOCSTI can be Circumvented
CVE-2019-7303MEDIUMdoslinux
Snapd seccomp filter TIOCSTI ioctl bypass
33RISK
open ↗
Referência
CVE-2008-7010
CVE-2008-7010—
Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers to add new administrators and gain privileges via a
23RISK
open ↗
Referência
CVE-2023-7304
CVE-2023-7304CRITICAL
Ruijie RG-UAC nmc_sync.php Command Injection
48RISK
open ↗
Referência
CVE-2009-4147
CVE-2009-4147—
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear t
38RISK
open ↗
Referência
CVE-2016-3643
CVE-2016-3643HIGHunder attack
SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguratio
71RISK
open ↗
Referência
CVE-2015-4631
CVE-2015-4631—
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before
23RISK
open ↗
Referência
CVE-2015-7346
CVE-2015-7346—
SQL injection vulnerability in ZCMS 1.1.
23RISK
open ↗
Referência
CVE-2021-44916
CVE-2021-44916—
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad
23RISK
open ↗
Referência✓ VexDay Proof
eIQnetworks ESA SEARCHREPORT - Remote Overflow (Metasploit)
CVE-2007-5699—remotewindows
Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2026-87918
CVE-2026-87918MEDIUM
WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
33RISK
open ↗
Referência✓ VexDay Proof
PolDoc CMS 0.96 - 'download_file.php' File Disclosure
CVE-2007-6400—webappsphp
Directory traversal vulnerability in download_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read ar
23RISK
open ↗
Referência✓ VexDay Proof
MX-System 2.7.3 - 'index.php' SQL Injection
CVE-2008-2477—webappsphp
SQL injection vulnerability in index.php in MxBB (aka MX-System) Portal 2.7.3 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
ProArcadeScript 1.3 - 'random' SQL Injection
CVE-2008-4173—webappsphp
SQL injection vulnerability in ProArcadeScript 1.3 allows remote attackers to execute arbitrary SQL commands via the ran
23RISK
open ↗
Referência
CVE-2023-33863
CVE-2023-33863CRITICAL
SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-
48RISK
open ↗
Referência
CVE-2016-0728
CVE-2016-0728—
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
23RISK
open ↗
Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' 'HREF' Universal Buffer Overflow
CVE-2009-0174—localwindows
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RISK
open ↗
Referência
CVE-2026-10176
CVE-2026-10176MEDIUM
Aider-AI Aider Code Generation Workflow sql injection
33RISK
open ↗
Referência
CVE-2026-10175
CVE-2026-10175MEDIUM
Aider-AI Aider Architect Mode auth.py editor_coder.run code injection
33RISK
open ↗
Referência
CVE-2019-6214
CVE-2019-6214—
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.1
23RISK
open ↗
Referência✓ VexDay Proof
Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite
CVE-2009-0465—remotewindows
The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX
23RISK
open ↗
Referência
CVE-2009-4386
CVE-2009-4386—
SQL injection vulnerability in hotel_tiempolibre_ext.php in Venalsur Booking Centre Booking System for Hotels Group, whe
23RISK
open ↗
Referência✓ VexDay Proof
openPHPNuke 2.3.3 - Remote File Inclusion
CVE-2006-2137—webappsphp
PHP remote file inclusion vulnerability in master.php in OpenPHPNuke and 2.3.3 earlier allows remote attackers to execut
23RISK
open ↗
← previouspage 731 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.