Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência
CVE-2019-17624
CVE-2019-17624—
"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sendin
23RISK
open ↗
Referência
CVE-2018-0968
CVE-2018-0968—
An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve informatio
23RISK
open ↗
Referência
Authenticated low-privileged RCE in Coolify via unsanitized shell commands in the Git Repository field.
CVE-2025-34161CRITICAL
Coolify Git Repository Field Command Injection in Project Deployment Workflow
48RISK
open ↗
Referência
CVE-2015-2275
CVE-2015-2275—
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i
23RISK
open ↗
Referência
CVE-2015-2275
CVE-2015-2275—
Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to i
23RISK
open ↗
Referência
CVE-2022-39285
CVE-2022-39285HIGH
Stored Cross-Site Scripting Vulnerability In File Parameter in zoneminder
41RISK
open ↗
Referência
CVE-2015-1028
CVE-2015-1028—
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remo
23RISK
open ↗
Referência
CVE-2026-4567
CVE-2026-4567CRITICAL
Tenda A15 UploadCfg stack-based overflow
48RISK
open ↗
Referência
CVE-2022-3481
CVE-2022-3481CRITICAL
WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi
63RISK
open ↗
Referência
CVE-2020-14943
CVE-2020-14943—
The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cros
23RISK
open ↗
Referência
CVE-2006-4853
CVE-2006-4853—
SQL injection vulnerability in kategorix.asp in Haberx 1.02 through 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1067—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web
23RISK
open ↗
Referência
CVE-2010-1302
CVE-2010-1302—
Directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs (com_dwgraphs) component 1.0 for Joomla! a
38RISK
open ↗
Referência✓ VexDay Proof
Neon Labs Website 3.2 - 'nl.php?g_strRootDir' Remote File Inclusion
CVE-2007-0496—webappsphp
PHP remote file inclusion vulnerability in lib/nl/nl.php in Neon Labs Website (nlws) 3.2 and earlier allows remote attac
23RISK
open ↗
Referência✓ VexDay Proof
TeamCalPro 3.1.000 - Multiple Local/Remote File Inclusions
CVE-2007-6553—webappsphp
Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute
23RISK
open ↗
Referência
X.Org X Server 1.20.4 - Local Stack Overflow
CVE-2019-17624—locallinux
"" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sendin
23RISK
open ↗
Referência
BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting
CVE-2020-14943—webappsmultiple
The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cros
23RISK
open ↗
Referência
CVE-2018-14888
CVE-2018-14888—
inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or threa
23RISK
open ↗
Referência
CVE-2018-14888
CVE-2018-14888—
inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or threa
23RISK
open ↗
Referência
CVE-2013-1604
CVE-2013-1604—
Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers
23RISK
open ↗
Referência
CVE-2018-5405
CVE-2018-5405—
The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.
23RISK
open ↗
Referência
CVE-2023-3848
CVE-2023-3848LOW
mooSocial mooDating URL view cross site scripting
43RISK
open ↗
Referência
CVE-2017-8708
CVE-2017-8708—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RISK
open ↗
Referência
CVE-2019-16173
CVE-2019-16173—
LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example,
23RISK
open ↗
Referência
CVE-2022-2841
CVE-2022-2841LOW
CrowdStrike Falcon Uninstallation authorization
28RISK
open ↗
Referência
CVE-2014-2340
CVE-2014-2340—
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers
23RISK
open ↗
Referência
CVE-2015-7567
CVE-2015-7567—
SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw
23RISK
open ↗
Referência
CVE-2015-7567
CVE-2015-7567—
SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw
23RISK
open ↗
Referência✓ VexDay Proof
@lex Guestbook 4.0.2 - Remote Command Execution
CVE-2007-0202—webappsphp
SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência
CVE-2021-21465
CVE-2021-21465CRITICAL
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the b
48RISK
open ↗
← previouspage 294 / 724next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.