Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência
CVE-2026-17016
CVE-2026-17016LOW
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment
28RISK
open ↗
Referência
CVE-2014-5112
CVE-2014-5112—
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacha
23RISK
open ↗
Referência
CVE-2014-5115
CVE-2014-5115—
Absolute path traversal vulnerability in DirPHP 1.0 allows remote attackers to read arbitrary files via a full pathname
23RISK
open ↗
Referência
CVE-2026-17012
CVE-2026-17012MEDIUM
Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email
33RISK
open ↗
Referência
CVE-2015-6102
CVE-2015-6102—
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗
Referência
CVE-2014-5194
CVE-2014-5194—
Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbi
23RISK
open ↗
Referência
CVE-2014-5207
CVE-2014-5207—
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOE
23RISK
open ↗
Referência
CVE-2014-5207
CVE-2014-5207—
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOE
23RISK
open ↗
Referência
CVE-2014-5216
CVE-2014-5216—
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
23RISK
open ↗
Referência
CVE-2014-5246
CVE-2014-5246—
The Shenzhen Tenda Technology Tenda A5s router with firmware 3.02.05_CN allows remote attackers to bypass authentication
28RISK
open ↗
Referência
CVE-2014-5275
CVE-2014-5275—
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote au
23RISK
open ↗
Referência
CVE-2014-5276
CVE-2014-5276—
Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated u
23RISK
open ↗
Referência
CVE-2014-5284
CVE-2014-5284—
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, whi
23RISK
open ↗
Referência
CVE-2014-5287
CVE-2014-5287—
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input i
23RISK
open ↗
Referência
CVE-2014-5347
CVE-2014-5347—
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress
23RISK
open ↗
Referência
CVE-2014-5395
CVE-2014-5395—
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13S
23RISK
open ↗
Referência
CVE-2014-5520
CVE-2014-5520—
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2014-6030
CVE-2014-6030—
Multiple SQL injection vulnerabilities in ClassApps SelectSurvey.NET before 4.125.002 allow (1) remote attackers to exec
23RISK
open ↗
Referência
CVE-2014-6043
CVE-2014-6043—
ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database
28RISK
open ↗
Referência
CVE-2015-6827
CVE-2015-6827—
Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentica
23RISK
open ↗
Referência
CVE-2015-6923
CVE-2015-6923—
The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary phy
23RISK
open ↗
Referência
CVE-2015-6923
CVE-2015-6923—
The ndvbs module in VBox Communications Satellite Express Protocol 2.3.17.3 allows local users to write to arbitrary phy
23RISK
open ↗
Referência
CVE-2026-3430
CVE-2026-3430HIGH
Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi
41RISK
open ↗
Referência
CVE-2026-70637
CVE-2026-70637HIGH
LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c
41RISK
open ↗
Referência
CVE-2010-0373
CVE-2010-0373—
SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2026-19019
CVE-2026-19019MEDIUM
poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup
33RISK
open ↗
Referência
CVE-2026-19019
CVE-2026-19019MEDIUM
poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup
33RISK
open ↗
Referência
CVE-2026-19011
CVE-2026-19011MEDIUM
TinyAGI agents.ts buildSystemPrompt file inclusion
33RISK
open ↗
Referência
CVE-2026-19010
CVE-2026-19010MEDIUM
TinyAGI Message API Endpoint index.ts processMessage authorization
33RISK
open ↗
Referência
CVE-2026-19009
CVE-2026-19009MEDIUM
TinyAGI Message API Endpoint response.ts collectFiles file inclusion
33RISK
open ↗
← previouspage 585 / 751next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.