Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,298cataloged exploits
35,468CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,137VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2014-2364
CVE-2014-2364—
Advantech WebAccess Stack-Based Buffer Overflow
68RISK
open ↗
Referência
CVE-2014-2399
CVE-2014-2399—
Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attacker
23RISK
open ↗
Referência
CVE-2025-71326
CVE-2025-71326HIGH
AVAST Antivirus 25.11 Unquoted Service Path Privilege Escalation
41RISK
open ↗
Referência✓ VexDay Proof
F-PROT AntiVirus 6.2.1.4252 - Malformed Archive Infinite Loop Denial of Service
CVE-2008-3447—dosmultiple
The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop)
23RISK
open ↗
Referência
CVE-2014-2424
CVE-2014-2424—
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote
50RISK
open ↗
Referência✓ VexDay Proof
eNdonesia 8.4 (Calendar Module) - SQL Injection
CVE-2008-3452—webappsphp
SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Insecure Cookie Handling
CVE-2008-3454—webappsphp
JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by se
23RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência✓ VexDay Proof
PHP Hosting Directory 2.0 - Remote File Inclusion
CVE-2008-3455—webappsphp
PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attacke
23RISK
open ↗
Referência
CVE-2026-46331
CVE-2026-46331HIGH
net/sched: fix pedit partial COW leading to page cache corruption
41RISK
open ↗
Referência
CVE-2026-12210
CVE-2026-12210MEDIUM
universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery
33RISK
open ↗
Referência
CVE-2026-12209
CVE-2026-12209MEDIUM
RubyLouvre avalon Template Filter index.js prototype pollution
33RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência✓ VexDay Proof
Anzio Web Print Object 3.2.30 - ActiveX Buffer Overflow
CVE-2008-3480—remotewindows
Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Pri
28RISK
open ↗
Referência
CVE-2019-13272
CVE-2019-13272HIGHunder attack
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗
Referência✓ VexDay Proof
eStoreAff 0.1 - 'cid' SQL Injection
CVE-2008-3484—webappsphp
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid param
23RISK
open ↗
Referência
CVE-2024-58349
CVE-2024-58349CRITICAL
WordPress Theme Travelscape 1.0.3 Arbitrary File Upload
48RISK
open ↗
Referência
CVE-2024-58348
CVE-2024-58348CRITICAL
WordPress Background Image Cropper 1.2 Remote Code Execution
48RISK
open ↗
Referência
CVE-2023-54352
CVE-2023-54352CRITICAL
WordPress Seotheme Remote Code Execution Unauthenticated
48RISK
open ↗
Referência
CVE-2014-3704
CVE-2014-3704—
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2019-1653
CVE-2019-1653HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Referência
CVE-2011-2841
CVE-2011-2841—
Google Chrome before 14.0.835.163 does not properly perform garbage collection during the processing of PDF documents, w
23RISK
open ↗
← previouspage 454 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.