Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Joomla! Component Social Factory 3.8.3 - SQL Injection
SQL Injection exists in the Social Factory 3.8.3 component for Joomla! via the radius[lat], radius[lng], or radius[radiu
23RISK
open ↗Exploit-DB
Joomla! Component Collection Factory 4.1.9 - SQL Injection
SQL Injection exists in the Collection Factory 4.1.9 component for Joomla! via the filter_order or filter_order_Dir para
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::SVGTextLayoutAttributes::context' Use-After-Free
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Swap Factory 2.2.1 - SQL Injection
SQL Injection exists in the Swap Factory 2.2.1 component for Joomla! via the filter_order_Dir or filter_order parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::RenderMultiColumnSet::updateMinimumColumnHeight' Use-After-Free
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
23RISK
open ↗Exploit-DB
LG SuperSign EZ CMS 2.5 - Remote Code Execution
LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getT
50RISK
open ↗Exploit-DB
Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 fo
23RISK
open ↗Exploit-DB
MyBB Visual Editor 1.8.18 - Cross-Site Scripting
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
45RISK
open ↗Exploit-DB✓ VexDay Proof
WebRTC - FEC Out-of-Bounds Read
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebRTC - VP9 Processing Use-After-Free
A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap
23RISK
open ↗Exploit-DB
WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
50RISK
open ↗Exploit-DB
WordPress Plugin Localize My Post 1.0 - Local File Inclusion
The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.
50RISK
open ↗Exploit-DB
Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters sec
23RISK
open ↗Exploit-DB
LG SuperSign EZ CMS 2.5 - Local File Inclusion
LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'CiSetFileCache' WDAC Security Feature Bypass TOCTOU
A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security F
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Double Dereference in NtEnumerateKey Elevation of Privilege
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - 'localeCompare' Type Confusion
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'PathTypeHandlerBase::SetAttributesHelper' Type Confusion
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris - libnspr NSPR_LOG_FILE Privilege Escalation (Metasploit)
The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in Sun Solaris 10, trusts user-specified environment v
38RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:4
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require ad
23RISK
open ↗Exploit-DB
WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.