Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,644cataloged exploits
40,922CVEs with public exploitation
24,696lab-tested
AllReferência 26,560Exploit-DB 24,489GitHub PoC 18,407VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,560 exploits
Referência
CVE-2016-4135
CVE-2016-4135—
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsof
28RISK
open ↗
Referência
CVE-2016-4228
CVE-2016-4228—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗
Referência✓ VexDay Proof
phpBB SpamBlocker Mod 1.0.2 - Remote File Inclusion
CVE-2006-5301—webappsphp
PHP remote file inclusion vulnerability in includes/antispam.php in the SpamBlockerMODv 1.0.2 and earlier module for php
23RISK
open ↗
Referência✓ VexDay Proof
Transmit.app 3.5.5 - 'ftps://' URL Handler Heap Buffer Overflow (PoC)
CVE-2007-0020—dososx
Heap-based buffer overflow in the SFTP protocol handler for Panic Transmit (Transmit.app) up to 3.5.5 allows remote atta
23RISK
open ↗
Referência
CVE-2026-19925
CVE-2026-19925MEDIUM
SourceCodester Stock Management System Master.php delete_supplier sql injection
33RISK
open ↗
Referência
CVE-2016-4313
CVE-2016-4313—
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2016-4437
CVE-2016-4437CRITICALunder attack
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RISK
open ↗
Referência
CVE-2026-93309
CVE-2026-93309MEDIUM
O-RAN-SC SMO OAM VES Collector allocation of resources
33RISK
open ↗
Referência
CVE-2016-1525
CVE-2016-1525—
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Referência
CVE-2019-1619
CVE-2019-1619CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗
Referência
CVE-2019-16117
CVE-2019-16117—
Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admi
23RISK
open ↗
Referência
CVE-2026-63764
CVE-2026-63764HIGH
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
41RISK
open ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗
Referência
CVE-2026-92920
CVE-2026-92920MEDIUM
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
33RISK
open ↗
Referência
CVE-2026-92919
CVE-2026-92919HIGH
admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
41RISK
open ↗
Referência
CVE-2014-10079
CVE-2014-10079—
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hid
23RISK
open ↗
Referência✓ VexDay Proof
ig shop 1.0 - Code Execution / SQL Injection
CVE-2007-0134—webappsphp
Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the
28RISK
open ↗
Referência
CVE-2019-16119
CVE-2019-16119—
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/control
28RISK
open ↗
Referência
CVE-2026-93454
CVE-2026-93454MEDIUM
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
33RISK
open ↗
Referência✓ VexDay Proof
Aratix 0.2.2b11 - '/inc/init.inc.php' Remote File Inclusion
CVE-2007-0135—webappsphp
PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals i
23RISK
open ↗
Referência✓ VexDay Proof
vp-asp shopping cart 6.09 - SQL Injection / Cross-Site Scripting
CVE-2007-0225—webappsasp
Cross-site scripting (XSS) vulnerability in shopcustadmin.asp in VP-ASP Shopping Cart 6.09 and earlier allows remote att
23RISK
open ↗
Referência
CVE-2023-54403
CVE-2023-54403HIGH
Yonyou U8 CRM Arbitrary File Read via getemaildata.php
41RISK
open ↗
Referência
CVE-2026-88791
CVE-2026-88791LOW
Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules
28RISK
open ↗
Referência
CVE-2017-16949
CVE-2017-16949—
An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper in
28RISK
open ↗
Referência
CVE-2026-102908
CVE-2026-102908MEDIUM
SourceCodester Online Reviewer Management System questions-view.php sql injection
33RISK
open ↗
Referência
CVE-2014-2598
CVE-2014-2598—
Cross-site request forgery (CSRF) vulnerability in the Quick Page/Post Redirect plugin before 5.0.5 for WordPress allows
23RISK
open ↗
Referência
CVE-2026-15254
CVE-2026-15254MEDIUM
Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode
33RISK
open ↗
Referência
CVE-2017-10046
CVE-2017-10046—
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (
23RISK
open ↗
Referência
CVE-2026-86518
CVE-2026-86518MEDIUM
code-projects Student Crud Operation edit.php sql injection
33RISK
open ↗
Referência
CVE-2015-2524
CVE-2015-2524—
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not proper
23RISK
open ↗
← previouspage 806 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.