Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2012-1017

CVE-2012-1017—

Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow rem

23RISK

open ↗

Referência

CVE-2025-25037

CVE-2025-25037CRITICAL

Aquatronica Controller System Complete Information Disclosure

63RISK

open ↗

Referência

CVE-2025-25037

CVE-2025-25037CRITICAL

Aquatronica Controller System Complete Information Disclosure

63RISK

open ↗

Referência

CVE-2022-50796

CVE-2022-50796CRITICAL

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

48RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-10037

CVE-2012-10037CRITICAL

PhpTax pfilez Parameter Exec Remote Code Injection

63RISK

open ↗

Referência

CVE-2012-3834

CVE-2012-3834—

SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OS

23RISK

open ↗

Referência

CVE-2012-6434

CVE-2012-6434—

Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke

23RISK

open ↗

Referência

CVE-2013-6162

CVE-2013-6162—

Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject ar

23RISK

open ↗

Referência

CVE-2017-17617

CVE-2017-17617—

Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.

23RISK

open ↗

Referência

CVE-2020-14946

CVE-2020-14946—

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and e

23RISK

open ↗

Referência

CVE-2009-2618

CVE-2009-2618—

SQL injection vulnerability in the Surveys (aka NS-Polls) module in MDPro (MD-Pro) 1.083.x allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2013-10066

CVE-2013-10066CRITICAL

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

63RISK

open ↗

Referência

CVE-2013-10066

CVE-2013-10066CRITICAL

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

63RISK

open ↗

Referência

CVE-2009-4446

CVE-2009-4446—

Cross-site scripting (XSS) vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitra

23RISK

open ↗

Referência

CVE-2009-2228

CVE-2009-2228—

Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web s

23RISK

open ↗

Referência

CVE-2013-2713

CVE-2013-2713—

Cross-site request forgery (CSRF) vulnerability in users_maint.html in KrisonAV CMS before 3.0.2 allows remote attackers

23RISK

open ↗

Referência

CVE-2026-85038

CVE-2026-85038MEDIUM

B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection

33RISK

open ↗

Referência★ 50

PoC for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways

CVE-2025-0282CRITICALunder attackransomware

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISK

open ↗

Referência

CVE-2026-84219

CVE-2026-84219HIGH

Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

41RISK

open ↗

Referência

CVE-2008-5971

CVE-2008-5971—

Cross-site scripting (XSS) vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated

23RISK

open ↗

Referência

CVE-2009-4468

CVE-2009-4468—

Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web scr

23RISK

open ↗

Referência

CVE-2009-4682

CVE-2009-4682—

Cross-site scripting (XSS) vulnerability in vote.php in Good/Bad Vote allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Referência

CVE-2015-8103

CVE-2015-8103—

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co

60RISK

open ↗

Referência

CVE-2017-17619

CVE-2017-17619—

Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.

23RISK

open ↗

Referência

CVE-2010-2358

CVE-2010-2358—

PHP remote file inclusion vulnerability in modules/catalog/upload_photo.php in Nakid CMS 0.5.2, when magic_quotes_gpc is

23RISK

open ↗

Referência

CVE-2024-10758

CVE-2024-10758MEDIUM

code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection

33RISK

open ↗

Referência

CVE-2023-51951

CVE-2023-51951CRITICAL

SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id

48RISK

open ↗

Referência

CVE-2021-33352

CVE-2021-33352CRITICAL

An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitra

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.