Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2019-18818
CVE-2019-18818—
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
60RISK
open ↗
Referência
CVE-2013-5748
CVE-2013-5748—
Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001
23RISK
open ↗
Referência
CVE-2019-18818
CVE-2019-18818—
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s
60RISK
open ↗
Referência
CVE-2013-5755
CVE-2013-5755—
config/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA) for the user account,
23RISK
open ↗
Referência
CVE-2017-0146
CVE-2017-0146HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2017-12617
CVE-2017-12617HIGHunder attack
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISK
open ↗
Referência
CVE-2001-0198
CVE-2001-0198—
Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a
23RISK
open ↗
Referência✓ VexDay Proof
Winamp 5.12 - '.pls' Remote Buffer Overflow (Perl) (2)
CVE-2006-0476—remotewindows
Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with
60RISK
open ↗
Referência
CVE-2013-6793
CVE-2013-6793—
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote a
23RISK
open ↗
Referência
CVE-2011-5130
CVE-2011-5130—
dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers t
50RISK
open ↗
Referência
CVE-2013-6881
CVE-2013-6881—
CRU Ditto Forensic FieldStation with firmware before 2013Oct15a allows remote attackers to execute arbitrary commands vi
28RISK
open ↗
Referência
CVE-2014-8739
CVE-2014-8739—
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery
60RISK
open ↗
Referência
CVE-2017-0412
CVE-2017-0412—
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbi
23RISK
open ↗
Referência
CVE-2014-5287
CVE-2014-5287—
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input i
23RISK
open ↗
Referência
CVE-2017-3316
CVE-2017-3316—
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions tha
23RISK
open ↗
Referência
CVE-2026-90974
CVE-2026-90974MEDIUM
WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update
33RISK
open ↗
Referência✓ VexDay Proof
flinx 1.3 - 'id' SQL Injection
CVE-2008-0468—webappsphp
SQL injection vulnerability in category.php in Flinx 1.3 and earlier allows remote attackers to execute arbitrary SQL co
23RISK
open ↗
Referência
CVE-2026-9810
CVE-2026-9810CRITICAL
AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
48RISK
open ↗
Referência
CVE-2017-1000353
CVE-2017-1000353CRITICALunder attack
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe
100RISK
open ↗
Referência
CVE-2020-37168
CVE-2020-37168CRITICAL
Ecommerce Systempay 1.0 Production Key Brute Force
48RISK
open ↗
Referência
CVE-2017-1000353
CVE-2017-1000353CRITICALunder attack
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe
100RISK
open ↗
Referência
CVE-2017-12786
CVE-2017-12786—
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW40
28RISK
open ↗
Referência
CVE-2017-14153
CVE-2017-14153—
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must
23RISK
open ↗
Referência
CVE-2026-29007
CVE-2026-29007MEDIUM
U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
33RISK
open ↗
Referência
CVE-2026-11571
CVE-2026-11571HIGH
Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts
41RISK
open ↗
Referência
CVE-2015-2051
CVE-2015-2051HIGHunder attack
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute ar
100RISK
open ↗
Referência
CVE-2026-50811
CVE-2026-50811MEDIUM
An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736
33RISK
open ↗
Referência
CVE-2011-5186
CVE-2011-5186—
Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2017-14717
CVE-2017-14717—
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.
23RISK
open ↗
Referência
CVE-2014-100003
CVE-2014-100003—
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗
← previouspage 792 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.