Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2017-8478
CVE-2017-8478—
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,
23RISK
open ↗
Referência
CVE-2023-27372
CVE-2023-27372CRITICAL
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗
Referência
CVE-2023-27372
CVE-2023-27372CRITICAL
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗
Referência
CVE-2023-27372
CVE-2023-27372CRITICAL
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗
Referência
CVE-2023-27372
CVE-2023-27372CRITICAL
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗
Referência
Microsoft Windows Server 2016 - Win32k Elevation of Privilege
CVE-2023-29336HIGHunder attacklocalwindows
Win32k Elevation of Privilege Vulnerability
83RISK
open ↗
Referência
CVE-2017-8917
CVE-2017-8917—
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISK
open ↗
Referência
CVE-2017-9128
CVE-2017-9128—
The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of
23RISK
open ↗
Referência
CVE-2023-4115
CVE-2023-4115MEDIUM
PHP Jabbers Cleaning Business index.php cross site scripting
48RISK
open ↗
Referência
CVE-2018-0296
CVE-2018-0296HIGHunder attack
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo
100RISK
open ↗
Referência
CVE-2018-10079
CVE-2018-10079—
Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users
23RISK
open ↗
Referência
CVE-2018-10079
CVE-2018-10079—
Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users
23RISK
open ↗
Referência
CVE-2018-10256
CVE-2018-10256—
A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privile
23RISK
open ↗
Referência
Microsoft Windows 11 - Kernel Privilege Escalation
CVE-2024-21338HIGHunder attackransomwarelocalwindows
Windows Kernel Elevation of Privilege Vulnerability
83RISK
open ↗
Referência
CVE-2024-22318
CVE-2024-22318MEDIUM
IBM i Access Client Solutions information disclosure
33RISK
open ↗
Referência
Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation
CVE-2024-28000CRITICALwebappsphp
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISK
open ↗
Referência
CVE-2018-11784
CVE-2018-11784—
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r
60RISK
open ↗
Referência
CVE-2018-12055
CVE-2018-12055—
Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.ph
23RISK
open ↗
Referência
CVE-2018-12523
CVE-2018-12523—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provi
23RISK
open ↗
Referência
CVE-2018-17394
CVE-2018-17394—
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
23RISK
open ↗
Referência
CVE-2018-17394
CVE-2018-17394—
SQL Injection exists in the Timetable Schedule 3.6.8 component for Joomla! via the eid parameter.
23RISK
open ↗
Referência
CVE-2018-17397
CVE-2018-17397—
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
23RISK
open ↗
Referência
CVE-2018-17397
CVE-2018-17397—
SQL Injection exists in the AlphaIndex Dictionaries 1.0 component for Joomla! via the letter parameter.
23RISK
open ↗
Referência
OpenSSH server (sshd) 9.8p1 - Race Condition
CVE-2024-6387HIGHremotelinux
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗
Referência★ 50
PoC for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways
CVE-2025-0282CRITICALunder attackransomware
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7
100RISK
open ↗
Referência
RPi-Jukebox-RFID 2.8.0 - Remote Command Execution
CVE-2025-10327MEDIUMwebappsmultiple
MiczFlor RPi-Jukebox-RFID shuffle.php os command injection
38RISK
open ↗
Referência
CVE-2025-10370
CVE-2025-10370MEDIUM
MiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting
33RISK
open ↗
Referência
CVE-2026-14239
CVE-2026-14239HIGH
Tourmaster < 5.4.8 - Stored XSS via CSRF
41RISK
open ↗
Referência
CVE-2026-13395
CVE-2026-13395HIGH
Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
41RISK
open ↗
Referência
CVE-2026-13345
CVE-2026-13345MEDIUM
Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table
33RISK
open ↗
← previouspage 460 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.