Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,660cataloged exploits
40,937CVEs with public exploitation
24,696lab-tested
AllReferência 26,570Exploit-DB 24,489GitHub PoC 18,413VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,570 exploits
Referência
CVE-2018-20062
CVE-2018-20062CRITICALunder attack
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP
100RISK
open ↗
Referência
CVE-2017-20265
CVE-2017-20265HIGH
Joomla! Component Flip Wall 8.0 SQL Injection
41RISK
open ↗
Referência
CVE-2017-20258
CVE-2017-20258HIGH
Joomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection
41RISK
open ↗
Referência
CVE-2017-20253
CVE-2017-20253HIGH
Joomla! Component My Projects 2.0 SQL Injection
41RISK
open ↗
Referência
CVE-2017-20252
CVE-2017-20252HIGH
Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter
41RISK
open ↗
Referência
CVE-2016-3646
CVE-2016-3646—
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
28RISK
open ↗
Referência
CVE-2016-3670
CVE-2016-3670—
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1
23RISK
open ↗
Referência
CVE-2018-0891
CVE-2018-0891—
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT
28RISK
open ↗
Referência
CVE-2018-0894
CVE-2018-0894—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2018-0895
CVE-2018-0895—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2018-10710
CVE-2018-10710—
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISK
open ↗
Referência
CVE-2018-20219
CVE-2018-20219—
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de
28RISK
open ↗
Referência
CVE-2026-11501
CVE-2026-11501MEDIUM
SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection
33RISK
open ↗
Referência
CVE-2017-1092
CVE-2017-1092—
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system a
60RISK
open ↗
Referência
CVE-2018-0897
CVE-2018-0897—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHunder attack
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗
Referência
CVE-2026-91752
CVE-2026-91752HIGH
GNU libextractor before 1.15 Stack Overflow via OLE2
41RISK
open ↗
Referência
CVE-2026-84059
CVE-2026-84059MEDIUM
ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
33RISK
open ↗
Referência
CVE-2026-13611
CVE-2026-13611MEDIUM
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
33RISK
open ↗
Referência
CVE-2017-12635
CVE-2017-12635—
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISK
open ↗
Referência
CVE-2017-12636
CVE-2017-12636—
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RISK
open ↗
Referência
CVE-2026-82909
CVE-2026-82909MEDIUM
QuantumNous new-api Revoked API Token token session expiration
33RISK
open ↗
Referência✓ VexDay Proof
SimpleBlog 2.0 - 'comments.asp' SQL Injection (2)
CVE-2006-4300—webappsphp
SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2025-5548
CVE-2025-5548MEDIUM
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗
Referência
CVE-2026-82691
CVE-2026-82691CRITICAL
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection
48RISK
open ↗
Referência
CVE-2026-82690
CVE-2026-82690CRITICAL
D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection
48RISK
open ↗
Referência
CVE-2026-19192
CVE-2026-19192HIGH
DeepCool DisplayService DeepCoolDisplayService.exe access control
41RISK
open ↗
Referência✓ VexDay Proof
Mambo Component bigAPE-Backup 1.1 - Remote File Inclusion
CVE-2006-4296—webappsphp
PHP remote file inclusion vulnerability in classes/Tar.php in bigAPE-Backup component (com_babackup) for Mambo 1.1 allow
23RISK
open ↗
Referência
CVE-2016-6600
CVE-2016-6600—
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
60RISK
open ↗
Referência
CVE-2016-6603
CVE-2016-6603—
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users v
45RISK
open ↗
← previouspage 812 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.