Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits

40,922CVEs with public exploitation

24,696lab-tested

All Referência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

26,560 exploits

Referência

CVE-2016-9651

CVE-2016-9651—

A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a

28RISK

open ↗

Referência

CVE-2014-5468

CVE-2014-5468—

A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf

50RISK

open ↗

Referência

CVE-2019-1652

CVE-2019-1652HIGHunder attack

Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability

100RISK

open ↗

Referência

CVE-2019-1652

CVE-2019-1652HIGHunder attack

Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability

100RISK

open ↗

Referência

CVE-2014-5207

CVE-2014-5207—

fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOE

23RISK

open ↗

Referência

CVE-2014-5246

CVE-2014-5246—

The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication

28RISK

open ↗

Referência

CVE-2014-5258

CVE-2014-5258—

Directory traversal vulnerability in showTempFile.php in webEdition CMS before 6.3.9.0 Beta allows remote authenticated

43RISK

open ↗

Referência

CVE-2014-5276

CVE-2014-5276—

Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated u

23RISK

open ↗

Referência

CVE-2013-5094

CVE-2013-5094—

Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to inj

23RISK

open ↗

Referência

CVE-2026-14923

CVE-2026-14923MEDIUM

Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

33RISK

open ↗

Referência

CVE-2026-14602

CVE-2026-14602CRITICAL

Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter

48RISK

open ↗

Referência

CVE-2013-5318

CVE-2013-5318—

SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang par

23RISK

open ↗

Referência

CVE-2013-5573

CVE-2013-5573—

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inj

23RISK

open ↗

Referência

CVE-2017-11830

CVE-2017-11830—

Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allow

23RISK

open ↗

Referência

CVE-2019-18818

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISK

open ↗

Referência

CVE-2013-5748

CVE-2013-5748—

Cross-site request forgery (CSRF) vulnerability in management/prioritize_planning.php in SimpleRisk before 20130916-001

23RISK

open ↗

Referência

CVE-2019-18818

CVE-2019-18818—

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISK

open ↗

Referência

CVE-2013-5755

CVE-2013-5755—

config/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA) for the user account,

23RISK

open ↗

Referência

CVE-2017-0146

CVE-2017-0146HIGHunder attackransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

open ↗

Referência

CVE-2017-12617

CVE-2017-12617HIGHunder attack

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT

100RISK

open ↗

Referência

CVE-2001-0198

CVE-2001-0198—

Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a

23RISK

open ↗

Referência

CVE-2017-7040

CVE-2017-7040—

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo

23RISK

open ↗

Referência

CVE-2013-7051

CVE-2013-7051—

D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

28RISK

open ↗

Referência

CVE-2017-14087

CVE-2017-14087—

A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Ho

23RISK

open ↗

Referência

CVE-2017-6097

CVE-2017-6097—

A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/camp

23RISK

open ↗

Referência

CVE-2017-8462

CVE-2017-8462—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RISK

open ↗

Referência

CVE-2018-25326

CVE-2018-25326HIGH

Google Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php

41RISK

open ↗

Referência

CVE-2018-25325

CVE-2018-25325HIGH

Woocommerce CSV Importer 3.3.6 Path Traversal File Deletion

41RISK

open ↗

Referência

CVE-2018-25322

CVE-2018-25322HIGH

Allok Fast AVI MPEG Splitter 1.2 Stack Based Buffer Overflow

41RISK

open ↗

Referência

CVE-2018-25321

CVE-2018-25321MEDIUM

TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.