Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits

40,804CVEs with public exploitation

24,696lab-tested

All Referência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecent popular risk

26,494 exploits

Referência

CVE-2012-6434

CVE-2012-6434—

Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attacke

23RISK

open ↗

Referência

CVE-2013-6162

CVE-2013-6162—

Cross-site scripting (XSS) vulnerability in Code-Crafters Ability Mail Server 3.1.1 allows remote attackers to inject ar

23RISK

open ↗

Referência

CVE-2017-17617

CVE-2017-17617—

Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.

23RISK

open ↗

Referência

CVE-2020-14946

CVE-2020-14946—

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and e

23RISK

open ↗

Referência

CVE-2009-2618

CVE-2009-2618—

SQL injection vulnerability in the Surveys (aka NS-Polls) module in MDPro (MD-Pro) 1.083.x allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2013-10066

CVE-2013-10066CRITICAL

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

63RISK

open ↗

Referência

CVE-2013-10066

CVE-2013-10066CRITICAL

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

63RISK

open ↗

Referência

CVE-2009-4446

CVE-2009-4446—

Cross-site scripting (XSS) vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitra

23RISK

open ↗

Referência

CVE-2009-2228

CVE-2009-2228—

Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web s

23RISK

open ↗

Referência

CVE-2013-2713

CVE-2013-2713—

Cross-site request forgery (CSRF) vulnerability in users_maint.html in KrisonAV CMS before 3.0.2 allows remote attackers

23RISK

open ↗

Referência

CVE-2026-85038

CVE-2026-85038MEDIUM

B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection

33RISK

open ↗

Referência★ 50

PoC for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways

CVE-2025-0282CRITICALunder attackransomware

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISK

open ↗

Referência

CVE-2026-84219

CVE-2026-84219HIGH

Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

41RISK

open ↗

Referência

CVE-2008-5971

CVE-2008-5971—

Cross-site scripting (XSS) vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated

23RISK

open ↗

Referência

CVE-2009-4468

CVE-2009-4468—

Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web scr

23RISK

open ↗

Referência

CVE-2009-4682

CVE-2009-4682—

Cross-site scripting (XSS) vulnerability in vote.php in Good/Bad Vote allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Referência

CVE-2015-8103

CVE-2015-8103—

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co

60RISK

open ↗

Referência

CVE-2017-17619

CVE-2017-17619—

Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.

23RISK

open ↗

Referência

CVE-2010-2358

CVE-2010-2358—

PHP remote file inclusion vulnerability in modules/catalog/upload_photo.php in Nakid CMS 0.5.2, when magic_quotes_gpc is

23RISK

open ↗

Referência

CVE-2016-8972

CVE-2016-8972—

IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the

23RISK

open ↗

Referência

CVE-2024-58393

CVE-2024-58393HIGH

i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php

41RISK

open ↗

Referência

CVE-2013-10070

CVE-2013-10070CRITICAL

PHP-Charts v1.0 PHP Code Execution

63RISK

open ↗

Referência

CVE-2013-10070

CVE-2013-10070CRITICAL

PHP-Charts v1.0 PHP Code Execution

63RISK

open ↗

Referência

CVE-2013-10070

CVE-2013-10070CRITICAL

PHP-Charts v1.0 PHP Code Execution

63RISK

open ↗

Referência

CVE-2012-10038

CVE-2012-10038CRITICAL

Auxilium RateMyPet Arbitrary File Upload RCE

63RISK

open ↗

Referência

CVE-2018-10828

CVE-2018-10828—

An issue was discovered in Alps Pointing-device Driver 10.1.101.207. ApMsgFwd.exe allows the current user to map and wri

23RISK

open ↗

Referência

CVE-2026-109188

CVE-2026-109188MEDIUM

jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints

33RISK

open ↗

Referência

CVE-2026-108882

CVE-2026-108882MEDIUM

JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser

33RISK

open ↗

Referência

CVE-2025-34089

CVE-2025-34089CRITICAL

Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection

63RISK

open ↗

Referência

CVE-2025-34089

CVE-2025-34089CRITICAL

Remote for Mac Unauthenticated Remote Code Execution via AppleScript Injection

63RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.