Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,662 exploits
Referência
CVE-2014-0793
CVE-2014-0793—
Multiple cross-site scripting (XSS) vulnerabilities in the StackIdeas Komento (com_komento) component before 1.7.3 for J
23RISK
open ↗
Referência
CVE-2014-10018
CVE-2014-10018—
Cross-site scripting (XSS) vulnerability in webconfig/wlan/country.html/country in the Teracom T2-B-Gawv1.4U10Y-BI modem
23RISK
open ↗
Referência
CVE-2010-1146
CVE-2010-1146—
The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the
23RISK
open ↗
Referência
CVE-2012-2592
CVE-2012-2592—
Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência
CVE-2012-2569
CVE-2012-2569—
Cross-site scripting (XSS) vulnerability in Synametrics Technologies Xeams 4.4 Build 5720 allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2026-5995
CVE-2026-5995CRITICAL
Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection
48RISK
open ↗
Referência
CVE-2026-10182
CVE-2026-10182MEDIUM
TRENDnet TEW-432BRP formWlanSetup command injection
33RISK
open ↗
Referência
CVE-2026-5996
CVE-2026-5996CRITICAL
Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection
48RISK
open ↗
Referência
CVE-2010-0678
CVE-2010-0678—
PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlie
23RISK
open ↗
Referência
CVE-2010-0678
CVE-2010-0678—
PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlie
23RISK
open ↗
Referência✓ VexDay Proof
Guestbara 1.2 - Change Admin Login and Password
CVE-2007-1553—webappsphp
admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of
23RISK
open ↗
Referência✓ VexDay Proof
Free Directory Script 1.1.1 - 'API_HOME_DIR' Remote File Inclusion
CVE-2008-6305—webappsphp
PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register_globals is enabled, al
23RISK
open ↗
Referência✓ VexDay Proof
Anata CMS 1.0b5 - 'change.php' Arbitrary Add Admin
CVE-2008-6665—webappsphp
change.php in Ananta CMS 1.0b5, with magic_quotes_gpc disabled, allows remote attackers to gain administrator privileges
23RISK
open ↗
Referência
CVE-2012-5700
CVE-2012-5700—
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2024-25003
CVE-2024-25003HIGH
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insuf
41RISK
open ↗
Referência
CVE-2024-25003
CVE-2024-25003HIGH
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insuf
41RISK
open ↗
Referência
CVE-2017-11320
CVE-2017-11320—
Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker
23RISK
open ↗
Referência
CVE-2021-24272
CVE-2021-24272—
Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS)
23RISK
open ↗
Referência
CVE-2016-2188
CVE-2016-2188—
The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximat
23RISK
open ↗
Referência
CVE-2012-2938
CVE-2012-2938—
Multiple cross-site scripting (XSS) vulnerabilities in Travelon Express 6.2.2 allow remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-5048
CVE-2010-5048—
Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.
23RISK
open ↗
Referência
CVE-2015-2999
CVE-2015-2999—
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary
23RISK
open ↗
Referência
CVE-2023-3897
CVE-2023-3897MEDIUM
Bypassing CAPTCHA & Enumerating Usernames via Password Reset Page
33RISK
open ↗
Referência✓ VexDay Proof
Alstrasoft e-Friends 4.21 - Admin Session Retrieve
CVE-2007-2824—webappsphp
SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
Interact 2.4.1 - Multiple Remote File Inclusions
CVE-2008-2220—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Interact Learning Community Environment Interact 2.4.1, when regis
23RISK
open ↗
Referência✓ VexDay Proof
cmsWorks 2.2 RC4 - 'mod_root' Remote File Inclusion
CVE-2008-2877—webappsphp
PHP remote file inclusion vulnerability in admin/include/lib.module.php in cmsWorks 2.2 RC4, when register_globals is en
23RISK
open ↗
Referência
CVE-2017-8422
CVE-2017-8422—
KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and le
23RISK
open ↗
Referência
CVE-2010-3490
CVE-2010-3490—
Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interfa
23RISK
open ↗
Referência
CVE-2012-1787
CVE-2012-1787—
Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attack
23RISK
open ↗
Referência
CVE-2009-3360
CVE-2009-3360—
Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web scrip
23RISK
open ↗
← previouspage 267 / 723next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.