Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,822 exploits
Referência
CVE-2014-7186
CVE-2014-7186—
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial o
35RISK
open ↗
Referência✓ VexDay Proof
IndexScript 3.0 - 'parent_id' SQL Injection
CVE-2008-6179—webappsphp
SQL injection vulnerability in sug_cat.php in IndexScript 3.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2010-5300
CVE-2010-5300—
Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash
28RISK
open ↗
Referência
CVE-2013-3532
CVE-2013-3532—
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote
23RISK
open ↗
Referência
Centos WebPanel 7 - 'term' SQL Injection
CVE-2020-10230—webappslinux
CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/adm
28RISK
open ↗
Referência
CVE-2022-24715
CVE-2022-24715HIGH
Arbitrary code execution for authenticated users in Icinga Web 2
46RISK
open ↗
Referência✓ VexDay Proof
Adobe 8.1.4/9.1 - 'customDictionaryOpen()' Code Execution
CVE-2009-1493—remotelinux
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and
28RISK
open ↗
Referência
CVE-2009-4680
CVE-2009-4680—
SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-1306
CVE-2010-1306—
Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote at
43RISK
open ↗
Referência
CVE-2009-3663
CVE-2009-3663—
Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to
28RISK
open ↗
Referência
CVE-2013-3537
CVE-2013-3537—
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência
CVE-2013-5220
CVE-2013-5220—
goform/login on the HOT HOTBOX router with software 2.1.11 allows remote attackers to cause a denial of service (device
23RISK
open ↗
Referência✓ VexDay Proof
SourceForge 1.0.4 - 'database.php' Remote File Inclusion
CVE-2006-5562—webappsphp
PHP remote file inclusion vulnerability in include/database.php in SourceForge (aka alexandria) 1.0.4 allows remote atta
23RISK
open ↗
Referência✓ VexDay Proof
BitchX 1.1 Final - MODE Remote Heap Overflow
CVE-2007-4584—remotelinux
Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in
28RISK
open ↗
Referência
CVE-2020-24223
CVE-2020-24223—
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.
43RISK
open ↗
Referência
CVE-2013-3893
CVE-2013-3893HIGHunder attack
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 throug
100RISK
open ↗
Referência
CVE-2026-15034
CVE-2026-15034MEDIUM
flask-dashboard Flask-MonitoringDashboard cross-site request forgery
33RISK
open ↗
Referência
CVE-2023-36812
CVE-2023-36812CRITICAL
Remote Code Execution in OpenTSDB
68RISK
open ↗
Referência
CVE-2013-3928
CVE-2013-3928—
Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta
50RISK
open ↗
Referência
CVE-2015-7246
CVE-2015-7246—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2020-5377
CVE-2020-5377CRITICAL
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.
60RISK
open ↗
Referência
EasyNas 1.1.0 - OS Command Injection
CVE-2023-0830MEDIUMremotehardware
EasyNAS backup.pl system os command injection
38RISK
open ↗
Referência
CVE-2026-19857
CVE-2026-19857MEDIUM
Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token
33RISK
open ↗
Referência✓ VexDay Proof
ABC Advertise 1.0 - Admin Password Disclosure
CVE-2009-1550—webappsphp
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to
23RISK
open ↗
Referência
CVE-2011-0917
CVE-2011-0917—
Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in
28RISK
open ↗
Referência
CVE-2026-14797
CVE-2026-14797MEDIUM
CodeAstro Apartment Visitor Management System edit-apartment.php sql injection
33RISK
open ↗
Referência
CVE-2014-4158
CVE-2014-4158—
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISK
open ↗
Referência✓ VexDay Proof
Mooseguy Blog System 1.0 - 'month' SQL Injection
CVE-2008-0424—webappsphp
SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗
← previouspage 98 / 861next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.