Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,559cataloged exploits
34,978CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,960VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,472✓ verified onlyrecentpopularrisk
21,899 exploits
Referência
CVE-2026-67215
CVE-2026-67215HIGH
cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion
41RISK
open ↗
Referência
CVE-2026-13690
CVE-2026-13690HIGH
UsersWP < 1.2.67 - Two-Factor Authentication Bypass
41RISK
open ↗
Referência✓ VexDay Proof
Mambo Component CopperminePhotoGalery - Remote File Inclusion
CVE-2006-4321—webappsphp
PHP remote file inclusion vulnerability in cpg.php in the Coppermine Photo Gallery component (com_cpg) 1.0 and earlier f
23RISK
open ↗
Referência✓ VexDay Proof
SFS Ez Forum - SQL Injection
CVE-2008-4754—webappsphp
SQL injection vulnerability in forum.php in Scripts for Sites (SFS) Ez Forum allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2026-67185
CVE-2026-67185HIGH
TinyWeb 0.0.8 Path Traversal via URL Path Component
41RISK
open ↗
Referência
CVE-2017-2533
CVE-2017-2533—
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "DiskArbitra
23RISK
open ↗
Referência
CVE-2021-28418
CVE-2021-28418—
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and
23RISK
open ↗
Referência
CVE-2018-10257
CVE-2018-10257—
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗
Referência
CVE-2018-10257
CVE-2018-10257—
A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗
Referência
CVE-2021-28419
CVE-2021-28419—
The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads
28RISK
open ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗
Referência
CVE-2018-14327
CVE-2018-14327—
The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before
23RISK
open ↗
Referência✓ VexDay Proof
Trawler Web CMS 1.8.1 - Multiple Remote File Inclusions
CVE-2006-5495—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Trawler Web CMS 1.8.1 and earlier allow remote attackers to execut
23RISK
open ↗
Referência
CVE-2023-23163
CVE-2023-23163—
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parame
23RISK
open ↗
Referência✓ VexDay Proof
ID Automation Linear Barcode - ActiveX Denial of Service
CVE-2007-2658—doswindows
Unspecified vulnerability in the ID Automation Linear Barcode 1.6.0.5 ActiveX control in IDAutomationLinear6.dll allows
23RISK
open ↗
Referência
CVE-2020-8777
CVE-2020-8777—
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo,
23RISK
open ↗
Referência
CVE-2026-66751
CVE-2026-66751MEDIUM
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
33RISK
open ↗
Referência
CVE-2014-5200
CVE-2014-5200—
SQL injection vulnerability in game_play.php in the FB Gorilla plugin for WordPress allows remote attackers to execute a
23RISK
open ↗
Referência
CVE-2013-4098
CVE-2013-4098—
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via
23RISK
open ↗
Referência
CVE-2012-5347
CVE-2012-5347—
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter
23RISK
open ↗
Referência
CVE-2018-1002000
CVE-2018-1002000—
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require ad
23RISK
open ↗
Referência
CVE-2023-1826
CVE-2023-1826MEDIUM
SourceCodester Online Computer and Laptop Store index.php unrestricted upload
33RISK
open ↗
Referência
CVE-2018-17784
CVE-2018-17784—
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthentic
23RISK
open ↗
Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
CVE-2009-1586—localwindows
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
PrecisionID Barcode ActiveX 1.9 - Arbitrary File Overwrite
CVE-2007-2755—remotewindows
The PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll, when Internet Explorer 6 is used, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Airsensor M520 - HTTPd Remote Denial of Service / Buffer Overflow (PoC)
CVE-2007-5036—doshardware
Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated
23RISK
open ↗
Referência
CVE-2026-14926
CVE-2026-14926MEDIUM
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
33RISK
open ↗
Referência✓ VexDay Proof
Natterchat 1.1 - Remote Authentication Bypass
CVE-2008-7047—webappsphp
NatterChat 1.1 allows remote attackers to bypass authentication and gain administrator privileges to read or delete room
23RISK
open ↗
Referência
CVE-2013-5672
CVE-2013-5672—
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗
Referência
CVE-2013-5672
CVE-2013-5672—
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow re
23RISK
open ↗
← previouspage 343 / 730next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.