Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência
CVE-2010-1305
CVE-2010-1305—
Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot
43RISK
open ↗
Referência
CVE-2017-2515
CVE-2017-2515—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2013-2618
CVE-2013-2618—
Cross-site scripting (XSS) vulnerability in editor.php in Network Weathermap before 0.97b allows remote attackers to inj
23RISK
open ↗
Referência
CVE-2011-2544
CVE-2011-2544—
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier a
23RISK
open ↗
Referência
CVE-2017-6371
CVE-2017-6371—
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string
23RISK
open ↗
Referência
CVE-2017-6371
CVE-2017-6371—
Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string
23RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2014-4166
CVE-2014-4166—
Cross-site scripting (XSS) vulnerability in the song history in SHOUTcast DNAS 2.2.1 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2015-8356
CVE-2015-8356—
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u
23RISK
open ↗
Referência
CVE-2023-0963
CVE-2023-0963HIGH
SourceCodester Music Gallery Site POST Request Users.php access control
41RISK
open ↗
Referência
CVE-2011-0887
CVE-2011-0887—
The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses pred
23RISK
open ↗
Referência
CVE-2014-1843
CVE-2014-1843—
Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attacke
38RISK
open ↗
Referência✓ VexDay Proof
Morovia Barcode ActiveX Professional 3.3.1304 - Arbitrary File Overwrite
CVE-2007-2644—remotewindows
A certain ActiveX control in Morovia Barcode ActiveX Professional 3.3.1304 allows remote attackers to overwrite arbitrar
23RISK
open ↗
Referência
CVE-2017-6999
CVE-2017-6999—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência
CVE-2017-6997
CVE-2017-6997—
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Referência
CVE-2016-10045
CVE-2016-10045—
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
60RISK
open ↗
Referência
CVE-2020-14883
CVE-2020-14883HIGHunder attack
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
Referência
CVE-2014-0112
CVE-2014-0112—
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all
60RISK
open ↗
Referência
CVE-2019-11599
CVE-2019-11599—
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la
23RISK
open ↗
Referência
CVE-2019-11599
CVE-2019-11599—
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la
23RISK
open ↗
Referência
CVE-2023-38831
CVE-2023-38831HIGHunder attackransomware
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
open ↗
Referência
CVE-2026-7740
CVE-2026-7740MEDIUM
justdan96 tsMuxer vvc.cpp setFPS denial of service
33RISK
open ↗
Referência
CVE-2026-7739
CVE-2026-7739MEDIUM
justdan96 tsMuxer hevc.cpp setFPS denial of service
33RISK
open ↗
Referência
CVE-2026-7738
CVE-2026-7738MEDIUM
puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversal
33RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-7057—webappsphp
Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbi
23RISK
open ↗
Referência✓ VexDay Proof
BandSite CMS 1.1.4 - Download Backup / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2008-7058—webappsphp
Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authenticati
23RISK
open ↗
Referência
WonderCMS 3.4.2 - Remote Code Execution (RCE)
CVE-2023-41425MEDIUMremotephp
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code
60RISK
open ↗
Referência
CVE-2025-32433
CVE-2025-32433CRITICALunder attack
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗
Referência
CVE-2016-7621
CVE-2016-7621—
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchO
23RISK
open ↗
← previouspage 297 / 724next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.