Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2016-0752
CVE-2016-0752HIGHunder attack
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.
100RISK
open ↗
Referência
CVE-2024-58397
CVE-2024-58397MEDIUM
MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
33RISK
open ↗
Referência
CVE-2017-0144
CVE-2017-0144HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2026-110774
CVE-2026-110774MEDIUM
Blinko through 1.8.8 Private Attachment Read via /api/file Route
33RISK
open ↗
Referência✓ VexDay Proof
Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
CVE-2006-5291—webappsphp
PHP remote file inclusion vulnerability in admin/includes/spaw/spaw_control.class.php in Download-Engine 1.4.2 allows re
23RISK
open ↗
Referência
CVE-2011-4342
CVE-2011-4342—
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows re
28RISK
open ↗
Referência
CVE-2017-20284
CVE-2017-20284HIGH
Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet
41RISK
open ↗
Referência
CVE-2016-1744
CVE-2016-1744—
The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary co
23RISK
open ↗
Referência
CVE-2011-4342
CVE-2011-4342—
PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows re
28RISK
open ↗
Referência
CVE-2026-111215
CVE-2026-111215HIGH
Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
41RISK
open ↗
Referência
CVE-2026-110772
CVE-2026-110772MEDIUM
Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update
33RISK
open ↗
Referência
CVE-2017-0144
CVE-2017-0144HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2026-110771
CVE-2026-110771MEDIUM
Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
33RISK
open ↗
Referência
CVE-2026-111217
CVE-2026-111217HIGH
Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
41RISK
open ↗
Referência
CVE-2026-111215
CVE-2026-111215HIGH
Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
41RISK
open ↗
Referência
CVE-2026-111214
CVE-2026-111214HIGH
Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
46RISK
open ↗
Referência✓ VexDay Proof
Vlog System 1.1 - SQL Injection
CVE-2008-6111—webappsphp
SQL injection vulnerability in blog.php in NetArt Media Vlog System 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2017-0145
CVE-2017-0145HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2026-9583
CVE-2026-9583MEDIUM
SourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure
33RISK
open ↗
Referência
CVE-2016-2385
CVE-2016-2385—
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER a
28RISK
open ↗
Referência
CVE-2026-7718
CVE-2026-7718MEDIUM
Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection
33RISK
open ↗
Referência
CVE-2021-47935
CVE-2021-47935HIGH
Sentry 8.2.0 Remote Code Execution via Pickle Deserialization
41RISK
open ↗
Referência
CVE-2026-19837
CVE-2026-19837MEDIUM
Webkul Bagisto Customer Search search information disclosure
33RISK
open ↗
Referência
CVE-2026-29004
CVE-2026-29004HIGH
BusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERS
41RISK
open ↗
Referência
CVE-2026-7717
CVE-2026-7717HIGH
Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow
41RISK
open ↗
Referência✓ VexDay Proof
Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion
CVE-2006-5384—webappsphp
PHP remote file inclusion vulnerability in modification/SendAlertEmail.php in CDS Software Consortium CDS Agenda 4.2.9 a
23RISK
open ↗
Referência
CVE-2026-110659
CVE-2026-110659MEDIUM
ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry
33RISK
open ↗
Referência
CVE-2017-0147
CVE-2017-0147HIGHunder attackransomware
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
Referência
CVE-2026-6602
CVE-2026-6602MEDIUM
rickxy Hospital Management System his_admin_account.php unrestricted upload
33RISK
open ↗
Referência
CVE-2026-7024
CVE-2026-7024MEDIUM
rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal
33RISK
open ↗
← previouspage 802 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.