Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,492 exploits
Referência
CVE-2020-25015
A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally
23RISK
open ↗Referência
CVE-2021-31762
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users fea
23RISK
open ↗Referência
CVE-2009-4224
Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to exec
23RISK
open ↗Referência
CVE-2013-5954
Multiple cross-site request forgery (CSRF) vulnerabilities in OpenX 2.8.11 and earlier allow remote attackers to hijack
23RISK
open ↗Referência
CVE-2018-18755
K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/up
23RISK
open ↗Referência
CVE-2018-18755
K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/up
23RISK
open ↗Referência✓ VexDay Proof
KDPics 1.11 - 'exif.php?lib_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrar
23RISK
open ↗Referência✓ VexDay Proof
CzarNews 1.14 - 'tpath' Remote File Inclusion
PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the
28RISK
open ↗Referência✓ VexDay Proof
FlashFXP 3.4.0 build 1145 - Remote Buffer Overflow (Denial of Service) (PoC)
FlashFXP 3.4.0 build 1145 allows remote servers to cause a denial of service (CPU consumption) via a response to a PWD c
23RISK
open ↗Referência✓ VexDay Proof
TorrentTrader Classic 1.07 - Multiple Vulnerabilities
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote att
23RISK
open ↗Referência
CVE-2012-5913
Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allo
38RISK
open ↗Referência
CVE-2023-23956
A user can supply malicious HTML and JavaScript code that will be executed in the client browser
33RISK
open ↗Referência
CVE-2009-2600
Multiple directory traversal vulnerabilities in view.php in Webboard 2.90 beta and earlier allow remote attackers to rea
23RISK
open ↗Referência
CVE-2016-6664
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
23RISK
open ↗Referência
CVE-2016-6664
mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server befo
23RISK
open ↗Referência
CVE-2020-7991
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
23RISK
open ↗Referência
CVE-2020-7991
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
23RISK
open ↗Referência
CVE-2021-21466
SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow
48RISK
open ↗Referência✓ VexDay Proof
ExBB 0.22 - Local/Remote File Inclusion
ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY_STRING for certain path manipulations, which al
23RISK
open ↗Referência
CVE-2009-4234
Cross-site scripting (XSS) vulnerability in loginpages/error_user.shtml on the Micronet Network Access Controller SP1910
23RISK
open ↗Referência
Joomla JS Jobs plugin 1.4.2 - SQL injection
Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla
41RISK
open ↗Referência✓ VexDay Proof
Mantis Bug Tracker 1.1.1 - Code Execution / Cross-Site Scripting / Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in manage_user_create.php in Mantis 1.1.1 allows remote attackers to cre
23RISK
open ↗Referência✓ VexDay Proof
Observer 0.3.2.1 - Multiple Remote Command Execution Vulnerabilities
Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query
28RISK
open ↗Referência
CVE-2013-3525
SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute
23RISK
open ↗Referência
CVE-2021-30030
Cross Site Scripting (XSS) in Remote Clinic v2.0 via the Full Name field on register-patient.php.
23RISK
open ↗Referência
CVE-2010-4398
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Wi
71RISK
open ↗Referência
CVE-2010-4398
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Wi
71RISK
open ↗Referência
CVE-2026-13400
Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information
33RISK
open ↗Referência✓ VexDay Proof
Google Chrome 1.0.154.53 - Null Pointer Remote Crash
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application
23RISK
open ↗Referência
CVE-2014-3704
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.