Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,062cataloged exploits

31,617CVEs with public exploitation

0lab-tested

All Exploit-DB 22,467Referência 19,791GitHub PoC 13,086VulnCheck XDB 8,069Nuclei 4,187Metasploit 3,462✓ verified onlyrecent popular risk

19,791 exploits

Referência

CVE-2018-14933

CVE-2018-14933CRITICALunder attack

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

100RISK

Referência

CVE-2013-0632

CVE-2013-0632CRITICALunder attack

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos

100RISK

Referência

CVE-2015-5122

CVE-2015-5122HIGHunder attack

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

100RISK

Referência

CVE-2015-5122

CVE-2015-5122HIGHunder attack

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

100RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2018-6892

CVE-2018-6892—

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Referência

CVE-2023-36845

CVE-2023-36845CRITICALunder attack

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

Referência

CVE-2023-36845

CVE-2023-36845CRITICALunder attack

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

Referência

CVE-2021-44077

CVE-2021-44077CRITICALunder attack

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014

100RISK

Referência

CVE-2020-8617

CVE-2020-8617HIGH

A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c

78RISK

Referência

CVE-2026-7219

CVE-2026-7219HIGH

Totolink N300RT formIpQoS buffer overflow

41RISK

Referência

CVE-2026-7218

CVE-2026-7218HIGH

Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow

41RISK

Referência

CVE-2019-7276

CVE-2019-7276—

Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.

60RISK

Referência

CVE-2018-10561

CVE-2018-10561CRITICALunder attack

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images

100RISK

Referência

CVE-2017-0143

CVE-2017-0143HIGHunder attackransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

Referência

CVE-2017-0143

CVE-2017-0143HIGHunder attackransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

Referência

CVE-2017-0143

CVE-2017-0143HIGHunder attackransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

Referência

CVE-2017-0143

CVE-2017-0143HIGHunder attackransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

Referência

CVE-2017-0143

CVE-2017-0143HIGHunder attackransomware

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

Referência★ 25

watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819

CVE-2025-57819CRITICALunder attack

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

Referência

CVE-2018-14912

CVE-2018-14912—

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned

60RISK

Referência

CVE-2020-5849

CVE-2020-5849HIGHunder attack

Unraid 6.8.0 allows authentication bypass.

100RISK

Referência

CVE-2016-4437

CVE-2016-4437CRITICALunder attack

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack

100RISK

Referência

CVE-2016-4437

CVE-2016-4437CRITICALunder attack

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.