Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,627cataloged exploits
40,914CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,390VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2015-5996
CVE-2015-5996—
Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allo
23RISK
open ↗
Referência
Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)
CVE-2020-17456—remotehardware
SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi pa
60RISK
open ↗
Referência
CVE-2010-2313
CVE-2010-2313—
Directory traversal vulnerability in index.php in Anodyne Productions SIMM Management System (SMS) 2.6.10, when magic_qu
23RISK
open ↗
Referência
CVE-2018-18435
CVE-2018-18435—
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any
23RISK
open ↗
Referência
CVE-2022-48079
CVE-2022-48079CRITICAL
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execu
48RISK
open ↗
Referência
CVE-2012-3872
CVE-2012-3872—
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
CVE-2009-1623—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2012-6585
CVE-2012-6585—
Cross-site scripting (XSS) vulnerability in search.php in MYRE Realty Manager allows remote attackers to inject arbitrar
23RISK
open ↗
Referência
CVE-2021-31650
CVE-2021-31650CRITICAL
A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary S
48RISK
open ↗
Referência
CVE-2018-18435
CVE-2018-18435—
KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any
23RISK
open ↗
Referência
CVE-2014-0981
CVE-2014-0981—
VBox/GuestHost/OpenGL/util/net.c in Oracle VirtualBox before 3.2.22, 4.0.x before 4.0.24, 4.1.x before 4.1.32, 4.2.x bef
23RISK
open ↗
Referência
CVE-2017-17737
CVE-2017-17737—
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diag
23RISK
open ↗
Referência
CVE-2009-3805
CVE-2009-3805—
gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (applic
23RISK
open ↗
Referência✓ VexDay Proof
Links Management Application 1.0 - 'lcnt' SQL Injection
CVE-2007-1339—webappsphp
SQL injection vulnerability in index.php in Links Management Application 1.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2010-2342
CVE-2010-2342—
SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers
23RISK
open ↗
Referência
CVE-2015-6810
CVE-2015-6810—
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB,
23RISK
open ↗
Referência
CVE-2014-8347
CVE-2014-8347—
An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 a
23RISK
open ↗
Referência
CVE-2010-2460
CVE-2010-2460—
SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers
23RISK
open ↗
Referência
CVE-2011-5185
CVE-2011-5185—
Cross-site scripting (XSS) vulnerability in video_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows re
23RISK
open ↗
Referência★ 302
Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x.
CVE-2025-38352HIGHunder attack
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
71RISK
open ↗
Referência
CVE-2013-10055
CVE-2013-10055CRITICAL
Havalite CMS Arbitary File Upload RCE
63RISK
open ↗
Referência
CVE-2013-10055
CVE-2013-10055CRITICAL
Havalite CMS Arbitary File Upload RCE
63RISK
open ↗
Referência
CVE-2017-17873
CVE-2017-17873—
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.
23RISK
open ↗
Referência
CVE-2017-17875
CVE-2017-17875—
The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.
23RISK
open ↗
Referência
RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)
CVE-2025-10370MEDIUMwebappsmultiple
MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting
33RISK
open ↗
Referência
CVE-2012-2585
CVE-2012-2585—
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to injec
23RISK
open ↗
Referência
CVE-2014-8347
CVE-2014-8347—
An Authentication Bypass vulnerability exists in the MatchPasswordData function in DBEngine.dll in Filemaker Pro 13.03 a
23RISK
open ↗
Referência
CVE-2017-1000408
CVE-2017-1000408—
A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environme
23RISK
open ↗
Referência
CVE-2026-8260
CVE-2026-8260HIGH
D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow
41RISK
open ↗
Referência
CVE-2026-108660
CVE-2026-108660MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
33RISK
open ↗
← previouspage 763 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.