Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,652cataloged exploits
34,545CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,581GitHub PoC 13,708VulnCheck XDB 8,225Nuclei 4,228Metasploit 3,467✓ verified onlyrecentpopularrisk
21,581 exploits
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2023-36845
CVE-2023-36845CRITICALunder attack
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗
Referência
CVE-2023-36845
CVE-2023-36845CRITICALunder attack
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗
Referência
CVE-2021-44077
CVE-2021-44077CRITICALunder attack
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014
100RISK
open ↗
Referência
CVE-2026-7219
CVE-2026-7219HIGH
Totolink N300RT formIpQoS buffer overflow
41RISK
open ↗
Referência
CVE-2026-7218
CVE-2026-7218HIGH
Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow
41RISK
open ↗
Referência
CVE-2009-2242
CVE-2009-2242—
SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2018-10561
CVE-2018-10561CRITICALunder attack
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência
CVE-2019-1663
CVE-2019-1663CRITICAL
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗
Referência★ 25
watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819
CVE-2025-57819CRITICALunder attack
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISK
open ↗
Referência
CVE-2018-14912
CVE-2018-14912—
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned
60RISK
open ↗
Referência
CVE-2019-16662
CVE-2019-16662—
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to a
60RISK
open ↗
Referência
CVE-2019-16662
CVE-2019-16662—
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to a
60RISK
open ↗
Referência
CVE-2016-4437
CVE-2016-4437CRITICALunder attack
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RISK
open ↗
Referência
CVE-2016-4437
CVE-2016-4437CRITICALunder attack
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RISK
open ↗
Referência
File Sharing Wizard 1.5.0 - POST SEH Overflow
CVE-2019-16724—remotewindows
File Sharing Wizard 1.5.0 allows a remote attacker to obtain arbitrary code execution by exploiting a Structured Excepti
60RISK
open ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALunder attack
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALunder attack
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Referência
CVE-2019-16759
CVE-2019-16759CRITICALunder attack
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Referência
CVE-2022-33891
CVE-2022-33891HIGHunder attack
Apache Spark shell command injection vulnerability via Spark UI
100RISK
open ↗
Referência
CVE-2023-41892
CVE-2023-41892CRITICAL
Craft CMS Remote Code Execution vulnerability
85RISK
open ↗
Referência
CVE-2016-4010
CVE-2016-4010—
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary
60RISK
open ↗
Referência
CVE-2016-4010
CVE-2016-4010—
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary
60RISK
open ↗
← previouspage 243 / 720next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.