Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,313cataloged exploits
34,834CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,797GitHub PoC 13,885VulnCheck XDB 8,484Nuclei 4,237Metasploit 3,467✓ verified onlyrecentpopularrisk
21,797 exploits
Referência
CVE-2009-4086
CVE-2009-4086—
CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP header
23RISK
open ↗
Referência
CVE-2020-15238
CVE-2020-15238HIGH
Local privilege escalation Blueman
41RISK
open ↗
Referência
CVE-2026-14554
CVE-2026-14554MEDIUM
Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
33RISK
open ↗
Referência
CVE-2026-14333
CVE-2026-14333HIGH
Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory
41RISK
open ↗
Referência
CVE-2013-5218
CVE-2013-5218—
Cross-site scripting (XSS) vulnerability on the HOT HOTBOX router with software 2.1.11 allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2012-3755
CVE-2012-3755—
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of s
28RISK
open ↗
Referência
CVE-2015-5784
CVE-2015-5784—
runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 does not properly dro
23RISK
open ↗
Referência
CVE-2026-14319
CVE-2026-14319HIGH
GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
41RISK
open ↗
Referência
CVE-2017-15223
CVE-2017-15223—
Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU re
23RISK
open ↗
Referência
CVE-2017-3630
CVE-2017-3630—
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t
38RISK
open ↗
Referência
CVE-2017-3630
CVE-2017-3630—
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t
38RISK
open ↗
Referência✓ VexDay Proof
Rising AntiVirus Online Scanner - Insecure Method Flaw
CVE-2008-1116—remotewindows
Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner all
28RISK
open ↗
Referência
CVE-2011-2938
CVE-2011-2938—
Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to
23RISK
open ↗
Referência
CVE-2014-3842
CVE-2014-3842—
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow
23RISK
open ↗
Referência
CVE-2014-3842
CVE-2014-3842—
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow
23RISK
open ↗
Referência✓ VexDay Proof
PunBB 1.2.16 - Blind Password Recovery
CVE-2008-1484—webappsphp
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which a
23RISK
open ↗
Referência
CVE-2026-14317
CVE-2026-14317MEDIUM
GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
33RISK
open ↗
Referência
CVE-2011-5049
CVE-2011-5049—
MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) vi
23RISK
open ↗
Referência
CVE-2021-42136
CVE-2021-42136—
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows
23RISK
open ↗
Referência✓ VexDay Proof
events Calendar 1.1 - Remote File Inclusion
CVE-2008-4673—webappsphp
PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Ca
23RISK
open ↗
Referência
CVE-2019-10874
CVE-2019-10874—
Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2019-10874
CVE-2019-10874—
Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2022-3982
CVE-2022-3982CRITICAL
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
Referência
CVE-2014-2045
CVE-2014-2045—
Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 30
23RISK
open ↗
Referência
CVE-2014-2045
CVE-2014-2045—
Multiple cross-site scripting (XSS) vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 30
23RISK
open ↗
Referência
CVE-2010-1528
CVE-2010-1528—
PHP remote file inclusion vulnerability in include/template.php in Uiga Proxy, when register_globals is enabled, allows
23RISK
open ↗
Referência
CVE-2009-4823
CVE-2009-4823—
Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote a
23RISK
open ↗
Referência
CVE-2019-10849
CVE-2019-10849—
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
23RISK
open ↗
Referência
CVE-2021-30149
CVE-2021-30149—
Composr 10.0.36 allows upload and execution of PHP files.
28RISK
open ↗
Referência
CVE-2015-2291
CVE-2015-2291HIGHunder attackransomware
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all
71RISK
open ↗
← previouspage 324 / 727next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.