Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,673cataloged exploits
40,945CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,425VulnCheck XDB 11,064Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência✓ VexDay Proof
Photoshop CS2/CS3 / Paint Shop Pro 11.20 - '.png' Local Buffer Overflow
CVE-2007-2365—localwindows
Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assist
35RISK
open ↗
Referência
CVE-2017-0214
CVE-2017-0214—
Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2
23RISK
open ↗
Referência
CVE-2016-3646
CVE-2016-3646—
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
28RISK
open ↗
Referência
CVE-2016-3670
CVE-2016-3670—
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1
23RISK
open ↗
Referência
CVE-2018-0891
CVE-2018-0891—
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT
28RISK
open ↗
Referência
CVE-2018-0894
CVE-2018-0894—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2018-0895
CVE-2018-0895—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2018-10710
CVE-2018-10710—
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISK
open ↗
Referência
CVE-2018-20219
CVE-2018-20219—
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de
28RISK
open ↗
Referência
CVE-2026-11501
CVE-2026-11501MEDIUM
SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection
33RISK
open ↗
Referência
CVE-2017-1092
CVE-2017-1092—
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system a
60RISK
open ↗
Referência
CVE-2018-0897
CVE-2018-0897—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2016-5195
CVE-2016-5195HIGHunder attack
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗
Referência
CVE-2026-91752
CVE-2026-91752HIGH
GNU libextractor before 1.15 Stack Overflow via OLE2
41RISK
open ↗
Referência
CVE-2026-84059
CVE-2026-84059MEDIUM
ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
33RISK
open ↗
Referência
CVE-2026-13611
CVE-2026-13611MEDIUM
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
33RISK
open ↗
Referência
CVE-2017-12635
CVE-2017-12635—
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISK
open ↗
Referência
CVE-2017-12636
CVE-2017-12636—
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RISK
open ↗
Referência
CVE-2026-82909
CVE-2026-82909MEDIUM
QuantumNous new-api Revoked API Token token session expiration
33RISK
open ↗
Referência
CVE-2018-14059
CVE-2018-14059—
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick,
23RISK
open ↗
Referência
CVE-2022-1631
CVE-2022-1631MEDIUM
Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber
33RISK
open ↗
Referência
CVE-2019-0731
CVE-2019-0731—
An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), ak
23RISK
open ↗
Referência
CVE-2016-5639
CVE-2016-5639—
Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13
28RISK
open ↗
Referência
CVE-2026-82699
CVE-2026-82699MEDIUM
sambitraj Student Management System Password aca.sql cleartext storage
33RISK
open ↗
Referência✓ VexDay Proof
SoftBB 0.1 - 'cmd' Remote Command Execution
CVE-2006-4633—webappsphp
index.php in SoftBB 0.1, and possibly earlier, allows remote attackers to obtain the installation path via a null or inv
23RISK
open ↗
Referência
CVE-2026-82698
CVE-2026-82698MEDIUM
sambitraj Student-Management-System aca.sql default password
33RISK
open ↗
Referência
CVE-2016-5674
CVE-2016-5674—
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR Rea
60RISK
open ↗
Referência✓ VexDay Proof
Muratsoft Haber Portal 3.6 - 'tr' SQL Injection
CVE-2006-4641—webappsasp
SQL injection vulnerability in kategori.asp in Muratsoft Haber Portal 3.6 allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência
CVE-2026-12971
CVE-2026-12971LOW
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
28RISK
open ↗
Referência
CVE-2018-10809
CVE-2018-10809—
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD)
23RISK
open ↗
← previouspage 816 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.