Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,636cataloged exploits
40,917CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,399VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2016-1807
Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watch
23RISK
open ↗Referência
CVE-2016-1807
Race condition in the Disk Images subsystem in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watch
23RISK
open ↗Referência
CVE-2026-44711
pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption
41RISK
open ↗Referência
CVE-2026-56099
OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input
33RISK
open ↗Referência
CVE-2026-38945
Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary cod
41RISK
open ↗Referência
CVE-2010-4963
SQL injection vulnerability in folder/list in Hulihan BXR 0.6.8 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Referência
CVE-2018-25323
Allok AVI DivX MPEG to DVD Converter 2.6.1217 Buffer Overflow SEH
41RISK
open ↗Referência
CVE-2026-7862
Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation
41RISK
open ↗Referência
CVE-2010-3148
Untrusted search path vulnerability in Microsoft Visio 2003 SP3 allows local users to gain privileges via a Trojan horse
28RISK
open ↗Referência✓ VexDay Proof
CityWriter 0.9.7 - 'head.php' Remote File Inclusion
PHP remote file inclusion vulnerability in head.php in CityWriter 0.9.7 allows remote attackers to execute arbitrary PHP
23RISK
open ↗Referência
CVE-2016-1863
The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local user
23RISK
open ↗Referência
CVE-2017-17098
The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote a
23RISK
open ↗Referência
CVE-2009-2934
Multiple stack-based buffer overflows in xaudio.dll in Programmed Integration PIPL 2.5.0 and 2.5.0D allow remote attacke
28RISK
open ↗Referência
CVE-2009-2961
Stack-based buffer overflow in Thaddy de Konng KOL Player 1.0 allows remote attackers to cause a denial of service (cras
23RISK
open ↗Referência
CVE-2010-3267
Multiple SQL injection vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to execute arbitr
23RISK
open ↗Referência✓ VexDay Proof
NewsLetter 3.5 - 'NL_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Knusperleicht Newsletter 3.5 and earlier allows remote attackers
23RISK
open ↗Referência
CVE-2010-3275
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a
60RISK
open ↗Referência
CVE-2010-4970
SQL injection vulnerability in handlers/getpage.php in Wiki Web Help 0.28 allows remote attackers to execute arbitrary S
23RISK
open ↗Referência
CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization
33RISK
open ↗Referência✓ VexDay Proof
Libera CMS 1.12 - 'cookie' SQL Injection
SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic_quotes_gpc is disabled, allows remot
23RISK
open ↗Referência
CVE-2026-8981
Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML
28RISK
open ↗Referência
CVE-2009-4599
Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers
23RISK
open ↗Referência
CVE-2026-11585
CodeAstro Student Attendance Management System createClassArms.php sql injection
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.