Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2025-9090
CVE-2025-9090MEDIUM
Tenda AC20 Telnet Service telnet websFormDefine command injection
38RISK
open ↗
Referência
CVE-2017-17610
CVE-2017-17610—
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid paramet
23RISK
open ↗
Referência
CVE-2017-2930
CVE-2017-2930—
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurre
28RISK
open ↗
Referência
CVE-2013-5962
CVE-2013-5962—
Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 r
28RISK
open ↗
Referência
CVE-2017-0148
CVE-2017-0148HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2017-15944
CVE-2017-15944CRITICALunder attack
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
100RISK
open ↗
Referência
CVE-2017-17645
CVE-2017-17645—
Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.
23RISK
open ↗
Referência
CVE-2025-9140
CVE-2025-9140MEDIUM
Shanghai Lingdang Information Technology Lingdang CRM tabdetail_moduleSave.php sql injection
33RISK
open ↗
Referência
CVE-2013-6117
CVE-2013-6117—
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio
60RISK
open ↗
Referência
Lingdang CRM 8.6.4.7 - SQL Injection
CVE-2025-9140MEDIUMwebappsmultiple
Shanghai Lingdang Information Technology Lingdang CRM tabdetail_moduleSave.php sql injection
33RISK
open ↗
Referência
CVE-2011-5166
CVE-2011-5166—
Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string
23RISK
open ↗
Referência
CVE-2026-8733
CVE-2026-8733MEDIUM
Investintech SlimPDFReader SlimPDFReader.exe sub_3B4610 stack-based overflow
33RISK
open ↗
Referência
CVE-2026-8731
CVE-2026-8731MEDIUM
Open5GS NRF client.c ogs_sbi_client_add denial of service
33RISK
open ↗
Referência
CVE-2026-8730
CVE-2026-8730MEDIUM
Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service
33RISK
open ↗
Referência
CVE-2026-8728
CVE-2026-8728MEDIUM
Open5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of service
33RISK
open ↗
Referência
CVE-2026-8725
CVE-2026-8725MEDIUM
CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side request forgery
33RISK
open ↗
Referência
CVE-2026-8724
CVE-2026-8724MEDIUM
Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
33RISK
open ↗
Referência
CVE-2026-9810
CVE-2026-9810CRITICAL
AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth
48RISK
open ↗
Referência
CVE-2017-1000353
CVE-2017-1000353CRITICALunder attack
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe
100RISK
open ↗
Referência
CVE-2020-37168
CVE-2020-37168CRITICAL
Ecommerce Systempay 1.0 Production Key Brute Force
48RISK
open ↗
Referência
CVE-2017-1000353
CVE-2017-1000353CRITICALunder attack
Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe
100RISK
open ↗
Referência
CVE-2017-12786
CVE-2017-12786—
Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW40
28RISK
open ↗
Referência
CVE-2017-14153
CVE-2017-14153—
This vulnerability allows local attackers to escalate privileges on Jungo WinDriver 12.4.0 and earlier. An attacker must
23RISK
open ↗
Referência
CVE-2026-29007
CVE-2026-29007MEDIUM
U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c
33RISK
open ↗
Referência
CVE-2026-11571
CVE-2026-11571HIGH
Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts
41RISK
open ↗
Referência
CVE-2015-2051
CVE-2015-2051HIGHunder attack
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute ar
100RISK
open ↗
Referência
CVE-2026-50811
CVE-2026-50811MEDIUM
An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736
33RISK
open ↗
Referência
CVE-2011-5186
CVE-2011-5186—
Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2017-14717
CVE-2017-14717—
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.
23RISK
open ↗
Referência
CVE-2014-100003
CVE-2014-100003—
SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for Wor
23RISK
open ↗
← previouspage 796 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.