Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,523 exploits
Referência
CVE-2025-34095
CVE-2025-34095CRITICAL
Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp
63RISK
open ↗
Referência
CVE-2015-2370
CVE-2015-2370—
The authentication implementation in the RPC subsystem in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP
23RISK
open ↗
Referência
CVE-2010-1702
CVE-2010-1702—
SQL injection vulnerability in submitticket.php in WHMCompleteSolution (WHMCS) 4.2 allows remote attackers to execute ar
23RISK
open ↗
Referência
CVE-2013-1804
CVE-2013-1804—
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2015-1060
CVE-2015-1060—
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect
23RISK
open ↗
Referência
CVE-2014-3153
CVE-2014-3153HIGHunder attack
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two diff
98RISK
open ↗
Referência
CVE-2013-3661
CVE-2013-3661—
The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vist
23RISK
open ↗
Referência
CVE-2012-4771
CVE-2012-4771—
Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitra
23RISK
open ↗
Referência
CVE-2016-1861
CVE-2016-1861—
The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privi
23RISK
open ↗
Referência✓ VexDay Proof
Maran PHP Forum - 'forum_write.php' Remote Code Execution
CVE-2007-2182—webappsphp
Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execu
23RISK
open ↗
Referência✓ VexDay Proof
Zenturi NixonMyPrograms Class 'sasatl.dll 1.5.0.531' - Remote Buffer Overflow
CVE-2007-3984—remotewindows
Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChec
23RISK
open ↗
Referência✓ VexDay Proof
Drupal 5.2 - PHP Zend Hash ation Vector
CVE-2007-5416—webappsphp
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value m
23RISK
open ↗
Referência✓ VexDay Proof
jspwiki 2.4.104/2.5.139 - Multiple Vulnerabilities
CVE-2008-1230—webappsjsp
Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbi
23RISK
open ↗
Referência✓ VexDay Proof
ACG-PTP 1.0.6 - 'adid' SQL Injection
CVE-2008-3944—webappsphp
SQL injection vulnerability in index.php in ACG-PTP 1.0.6 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2020-8777
CVE-2020-8777—
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo,
23RISK
open ↗
Referência
CVE-2026-66751
CVE-2026-66751MEDIUM
Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room
33RISK
open ↗
Referência
CVE-2014-3225
CVE-2014-3225—
Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated us
23RISK
open ↗
Referência
CVE-2013-4098
CVE-2013-4098—
ServerAdmin/ErrorViewer.jsp in DS3 Authentication Server allow remote attackers to inject arbitrary error-page text via
23RISK
open ↗
Referência✓ VexDay Proof
Grabit 1.7.2 Beta 3 - '.nzb' Local Buffer Overflow (SEH)
CVE-2009-1586—localwindows
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2012-5347
CVE-2012-5347—
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter
23RISK
open ↗
Referência
CVE-2018-1002000
CVE-2018-1002000—
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require ad
23RISK
open ↗
Referência✓ VexDay Proof
PrecisionID Barcode ActiveX 1.9 - Arbitrary File Overwrite
CVE-2007-2755—remotewindows
The PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll, when Internet Explorer 6 is used, allows remote
23RISK
open ↗
Referência
CVE-2023-1826
CVE-2023-1826MEDIUM
SourceCodester Online Computer and Laptop Store index.php unrestricted upload
33RISK
open ↗
Referência
CVE-2018-17784
CVE-2018-17784—
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthentic
23RISK
open ↗
Referência
CVE-2014-3247
CVE-2014-3247—
Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows remote authenticated users to inject arbitrary web scr
23RISK
open ↗
Referência
CVE-2018-11564
CVE-2018-11564—
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗
Referência
CVE-2018-11564
CVE-2018-11564—
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
23RISK
open ↗
Referência
CVE-2021-29447
CVE-2021-29447HIGH
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
Referência
CVE-2021-29447
CVE-2021-29447HIGH
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
Referência
CVE-2011-4898
CVE-2011-4898—
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error message
23RISK
open ↗
← previouspage 592 / 751next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.