Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,813cataloged exploits

35,788CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

22,549 exploits

Referência

CVE-2015-6104

CVE-2015-6104—

The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Window

35RISK

Referência

CVE-2015-6152

CVE-2015-6152—

Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory co

35RISK

Referência

CVE-2015-6541

CVE-2015-6541—

Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) be

23RISK

Referência

CVE-2026-15245

CVE-2026-15245MEDIUM

BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode

33RISK

Referência

CVE-2026-15215

CVE-2026-15215HIGH

Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

41RISK

Referência

CVE-2014-6271

CVE-2014-6271CRITICALunder attack

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Referência

CVE-2014-6271

CVE-2014-6271CRITICALunder attack

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Referência

CVE-2014-6271

CVE-2014-6271CRITICALunder attack

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Referência

CVE-2014-6271

CVE-2014-6271CRITICALunder attack

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Referência

CVE-2014-6271

CVE-2014-6271CRITICALunder attack

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Referência

CVE-2026-70636

CVE-2026-70636HIGH

Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

41RISK

Referência

CVE-2026-67622

CVE-2026-67622HIGH

Flowise 3.1.4 IDOR in OpenAI Assistants Integration

41RISK

Referência

CVE-2026-67621

CVE-2026-67621HIGH

Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

41RISK

Referência

CVE-2026-19110

CVE-2026-19110MEDIUM

DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting

33RISK

Referência

CVE-2026-19071

CVE-2026-19071MEDIUM

itsourcecode Hospital Management System viewappointment.php sql injection

33RISK

Referência

CVE-2026-19070

CVE-2026-19070MEDIUM

itsourcecode Hospital Management System viewadmin.php sql injection

33RISK

Referência

CVE-2015-7857

CVE-2015-7857—

SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p

60RISK

Referência

CVE-2010-0467

CVE-2010-0467—

Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attac

50RISK

Referência

CVE-2015-7858

CVE-2015-7858—

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un

60RISK

Referência

CVE-2015-7890

CVE-2015-7890—

Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung

23RISK

Referência

CVE-2021-33045

CVE-2021-33045CRITICALunder attack

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

100RISK

Referência★ 52

Scanner for CVE-2024-4040

CVE-2024-4040CRITICALunder attack

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RISK

Referência

CVE-2026-18582

CVE-2026-18582MEDIUM

mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap

33RISK

Referência

CVE-2015-8770

CVE-2015-8770—

Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before

28RISK

Referência

CVE-2010-0607

CVE-2010-0607—

Cross-site scripting (XSS) vulnerability in Forms/status_statistics_1 in the Sterlite SAM300 AX Router allows remote att

23RISK

Referência

CVE-2026-12500

CVE-2026-12500HIGH

WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update

41RISK

Referência

CVE-2026-11881

CVE-2026-11881MEDIUM

Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

33RISK

Referência

CVE-2026-11870

CVE-2026-11870MEDIUM

Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass

33RISK

Referência

CVE-2016-0099

CVE-2016-0099HIGHunder attackransomware

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8

98RISK

Referência

CVE-2016-0099

CVE-2016-0099HIGHunder attackransomware

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8

98RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.