Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
26,571 exploits
Referência
CVE-2018-0894
CVE-2018-0894—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2018-0895
CVE-2018-0895—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2018-0897
CVE-2018-0897—
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗
Referência
CVE-2016-3646
CVE-2016-3646—
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS
28RISK
open ↗
Referência
CVE-2016-3670
CVE-2016-3670—
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1
23RISK
open ↗
Referência
CVE-2017-1092
CVE-2017-1092—
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system a
60RISK
open ↗
Referência
CVE-2017-7293
CVE-2017-7293—
The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to
23RISK
open ↗
Referência
CVE-2026-82691
CVE-2026-82691CRITICAL
D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection
48RISK
open ↗
Referência
CVE-2026-82690
CVE-2026-82690CRITICAL
D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection
48RISK
open ↗
Referência✓ VexDay Proof
SimpleBlog 2.0 - 'comments.asp' SQL Injection (2)
CVE-2006-4300—webappsphp
SQL injection vulnerability in comments.asp in SimpleBlog 2.0 and earlier allows remote attackers to execute arbitrary S
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component bigAPE-Backup 1.1 - Remote File Inclusion
CVE-2006-4296—webappsphp
PHP remote file inclusion vulnerability in classes/Tar.php in bigAPE-Backup component (com_babackup) for Mambo 1.1 allow
23RISK
open ↗
Referência
CVE-2017-14619
CVE-2017-14619—
Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2026-19192
CVE-2026-19192HIGH
DeepCool DisplayService DeepCoolDisplayService.exe access control
41RISK
open ↗
Referência
CVE-2016-6600
CVE-2016-6600—
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
60RISK
open ↗
Referência
CVE-2017-15271
CVE-2017-15271—
A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. This issue could be
23RISK
open ↗
Referência
CVE-2016-6603
CVE-2016-6603—
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users v
45RISK
open ↗
Referência
CVE-2025-5548
CVE-2025-5548MEDIUM
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗
Referência
CVE-2017-15969
CVE-2017-15969—
PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_cata
23RISK
open ↗
Referência✓ VexDay Proof
PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion
CVE-2006-4670—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PhotoKorn Gallery 1.52 and earlier allow remote attackers to execu
28RISK
open ↗
Referência
CVE-2026-15939
CVE-2026-15939LOW
Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
28RISK
open ↗
Referência
CVE-2026-14222
CVE-2026-14222LOW
Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
28RISK
open ↗
Referência
CVE-2026-14820
CVE-2026-14820MEDIUM
Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login
33RISK
open ↗
Referência
CVE-2026-17433
CVE-2026-17433MEDIUM
nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
33RISK
open ↗
Referência
CVE-2004-2502
CVE-2004-2502—
im-switch before 11.4-46.1 in Fedora Core 2 allows local users to overwrite arbitrary files via a symlink attack on the
23RISK
open ↗
Referência
CVE-2026-16948
CVE-2026-16948HIGH
Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
41RISK
open ↗
Referência
CVE-2026-16267
CVE-2026-16267HIGH
Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
41RISK
open ↗
Referência
CVE-2026-19243
CVE-2026-19243MEDIUM
HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection
33RISK
open ↗
Referência
CVE-2026-17032
CVE-2026-17032CRITICAL
Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
48RISK
open ↗
Referência
CVE-2017-17111
CVE-2017-17111—
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
23RISK
open ↗
Referência
CVE-2026-13342
CVE-2026-13342MEDIUM
Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password
33RISK
open ↗
← previouspage 834 / 886next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.