Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,886cataloged exploits
32,153CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,282VulnCheck XDB 8,176Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
19,978 exploits
Referência
CVE-2006-3656
CVE-2006-3656—
Unspecified vulnerability in Microsoft PowerPoint 2003 allows user-assisted attackers to cause memory corruption via a c
28RISK
open ↗
Referência
CVE-2018-1322
CVE-2018-1322—
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte
28RISK
open ↗
Referência
CVE-2023-45498
CVE-2023-45498CRITICAL
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability
68RISK
open ↗
Referência
CVE-2023-45498
CVE-2023-45498CRITICAL
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability
68RISK
open ↗
Referência
CVE-2016-4175
CVE-2016-4175—
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
28RISK
open ↗
Referência
CVE-2016-4179
CVE-2016-4179—
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
28RISK
open ↗
Referência
Microsoft Rich Textbox Control 6.0-SP6 - 'SaveFile()' Insecure Method
CVE-2008-0237—
The Microsoft Rich Textbox ActiveX Control (RICHTX32.OCX) 6.1.97.82 allows remote attackers to execute arbitrary command
28RISK
open ↗
Referência
CVE-2013-1598
CVE-2013-1598—
A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to th
28RISK
open ↗
Referência
CVE-2018-5973
CVE-2018-5973—
SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter,
28RISK
open ↗
Referência
CVE-2018-5973
CVE-2018-5973—
SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter,
28RISK
open ↗
Referência
CVE-2009-3244
CVE-2009-3244—
Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remo
28RISK
open ↗
Referência
CVE-2018-9022
CVE-2018-9022—
An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to exec
28RISK
open ↗
Referência
CVE-2014-8768
CVE-2014-8768—
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RISK
open ↗
Referência
CVE-2014-8768
CVE-2014-8768—
Multiple Integer underflows in the geonet_print function in tcpdump 4.5.0 through 4.6.2, when in verbose mode, allow rem
28RISK
open ↗
Referência
CVE-2017-3068
CVE-2017-3068—
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced V
28RISK
open ↗
Referência
CVE-2018-13416
CVE-2018-13416—
In Universal Media Server (UMS) 7.1.0, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML Extern
28RISK
open ↗
Referência
CVE-2021-24946
CVE-2021-24946—
Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
60RISK
open ↗
Referência
CVE-2018-7313
CVE-2018-7313—
SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.
28RISK
open ↗
Referência
CVE-2018-6583
CVE-2018-6583—
SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.
28RISK
open ↗
Referência
CVE-2018-6006
CVE-2018-6006—
SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.
28RISK
open ↗
Referência
CVE-2018-5726
CVE-2018-5726—
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request,
28RISK
open ↗
Referência
CVE-2018-5726
CVE-2018-5726—
MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request,
28RISK
open ↗
Referência
CVE-2019-0573
CVE-2019-0573—
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations,
28RISK
open ↗
Referência
CVE-2023-4548
CVE-2023-4548MEDIUM
SPA-Cart eCommerce CMS GET Parameter search sql injection
38RISK
open ↗
Referência
CVE-2020-24881
CVE-2020-24881—
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
60RISK
open ↗
Referência
CVE-2018-6481
CVE-2018-6481—
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to exe
28RISK
open ↗
Referência
CVE-2018-6481
CVE-2018-6481—
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to exe
28RISK
open ↗
Referência
Xitami Web Server 2.5 - 'If-Modified-Since' Remote Buffer Overflow
CVE-2007-5067—
Multiple buffer overflows in iMatix Xitami Web Server 2.5c2 allow remote attackers to execute arbitrary code via a long
60RISK
open ↗
Referência
CVE-2013-1814
CVE-2013-1814—
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain s
60RISK
open ↗
Referência
CVE-2022-31161
CVE-2022-31161CRITICAL
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
68RISK
open ↗
← previouspage 106 / 666next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.