Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2021-31950
CVE-2021-31950HIGH
Microsoft SharePoint Server Spoofing Vulnerability
41RISK
open ↗
Referência
CVE-2010-1364
CVE-2010-1364—
SQL injection vulnerability in index.php in Uiga Personal Portal, as downloaded on 20100301, allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
HP Digital Imaging 'hpqvwocx.dll 2.1.0.556' - 'SaveToFile()' File Write
CVE-2007-3649—remotewindows
Absolute path traversal vulnerability in a certain ActiveX control in hpqvwocx.dll 2.1.0.556 in Hewlett-Packard (HP) Dig
23RISK
open ↗
Referência
CVE-2018-18324
CVE-2018-18324—
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter
23RISK
open ↗
Referência
CVE-2016-8016
CVE-2016-8016—
Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote
23RISK
open ↗
Referência
CVE-2021-24169
CVE-2021-24169—
Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)
43RISK
open ↗
Referência
CVE-2014-0683
CVE-2014-0683—
The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware
28RISK
open ↗
Referência
In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
CVE-2021-27828—webappsmultiple
SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the a
28RISK
open ↗
Referência
CVE-2014-7289
CVE-2014-7289—
SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and
23RISK
open ↗
Referência
CVE-2010-1366
CVE-2010-1366—
Multiple SQL injection vulnerabilities in admin/admin_login.php in Uiga Fan Club 1.0 and earlier allow remote attackers
23RISK
open ↗
Referência
CVE-2010-1366
CVE-2010-1366—
Multiple SQL injection vulnerabilities in admin/admin_login.php in Uiga Fan Club 1.0 and earlier allow remote attackers
23RISK
open ↗
Referência
CVE-2010-1368
CVE-2010-1368—
SQL injection vulnerability in index.php in GameScript (GS) 3.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2010-1368
CVE-2010-1368—
SQL injection vulnerability in index.php in GameScript (GS) 3.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2010-1369
CVE-2010-1369—
SQL injection vulnerability in signup.asp in Pre Classified Listings ASP allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2010-1369
CVE-2010-1369—
SQL injection vulnerability in signup.asp in Pre Classified Listings ASP allows remote attackers to execute arbitrary SQ
23RISK
open ↗
Referência
CVE-2010-1372
CVE-2010-1372—
SQL injection vulnerability in the HD FLV Player (com_hdflvplayer) component 1.3 for Joomla! allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-1431
CVE-2010-1431—
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2010-1461
CVE-2010-1461—
Directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attack
38RISK
open ↗
Referência
CVE-2010-1469
CVE-2010-1469—
Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for J
38RISK
open ↗
Referência
CVE-2010-1470
CVE-2010-1470—
Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read ar
43RISK
open ↗
Referência
CVE-2025-28137
CVE-2025-28137CRITICAL
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th
53RISK
open ↗
Referência
CVE-2010-1315
CVE-2010-1315—
Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1
38RISK
open ↗
Referência
CVE-2010-0317
CVE-2010-0317—
Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumptio
28RISK
open ↗
Referência
CVE-2013-6884
CVE-2013-6884—
The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and
28RISK
open ↗
Referência
CVE-2010-1472
CVE-2010-1472—
Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attac
43RISK
open ↗
Referência
CVE-2013-6884
CVE-2013-6884—
The write-blocker in CRU Ditto Forensic FieldStation with firmware before 2013Oct15a has a default "ditto" username and
28RISK
open ↗
Referência
CVE-2018-17980
CVE-2018-17980—
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
23RISK
open ↗
Referência
CVE-2018-17980
CVE-2018-17980—
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file lo
23RISK
open ↗
Referência
CVE-2012-4991
CVE-2012-4991—
Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated use
23RISK
open ↗
Referência
CVE-2021-27928
CVE-2021-27928—
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, a
35RISK
open ↗
← previouspage 253 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.