Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,794cataloged exploits

36,057CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,459Referência 22,721GitHub PoC 14,946VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecent popular risk

22,573 exploits

Referência✓ VexDay Proof

Yuhhu 2008 SuperStar - 'board' SQL Injection

CVE-2008-5270—webappsphp

SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2018-10660

CVE-2018-10660—

An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.

60RISK

open ↗

Referência

CVE-2015-6922

CVE-2015-6922—

Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before

60RISK

open ↗

Referência

CVE-2015-6922

CVE-2015-6922—

Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before

60RISK

open ↗

Referência

CVE-2017-0038

CVE-2017-0038—

gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows

45RISK

open ↗

Referência

CVE-2024-8957

CVE-2024-8957HIGHunder attack

PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

93RISK

open ↗

Referência

CVE-2019-7254

CVE-2019-7254—

Linear eMerge E3-Series devices allow File Inclusion.

60RISK

open ↗

Referência

CVE-2014-8440

CVE-2014-8440—

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on

60RISK

open ↗

Referência

CVE-2015-0336

CVE-2015-0336—

Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451

60RISK

open ↗

Referência

CVE-2017-8779

CVE-2017-8779—

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider t

60RISK

open ↗

Referência

CVE-2020-35578

CVE-2020-35578—

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature

60RISK

open ↗

Referência

CVE-2020-35578

CVE-2020-35578—

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature

60RISK

open ↗

Referência

CVE-2023-22232

CVE-2023-22232MEDIUM

Adobe Connect Improper Access Control Security feature bypass

70RISK

open ↗

Referência✓ VexDay Proof

SyndeoCMS 2.6.0 - Local File Inclusion / Cross-Site Scripting

CVE-2008-5271—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject

23RISK

open ↗

Referência✓ VexDay Proof

DeluxeBB 1.07 - Remote Create Admin

CVE-2006-3304—webappsphp

SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência✓ VexDay Proof

Todd Woolums ASP News Management 2.2 - SQL Injection

CVE-2008-5273—webappsasp

SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute a

23RISK

open ↗

Referência

CVE-2008-5281

CVE-2008-5281—

Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a lo

38RISK

open ↗

Referência

CVE-2009-2428

CVE-2009-2428—

Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2012-3153

CVE-2012-3153—

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and

60RISK

open ↗

Referência

CVE-2017-17641

CVE-2017-17641—

Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.

23RISK

open ↗

Referência✓ VexDay Proof

feedDemon 2.7 - OPML Outline Tag Buffer Overflow

CVE-2009-0546—localwindows

Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbi

50RISK

open ↗

Referência

CVE-2024-9464

CVE-2024-9464CRITICAL

Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

70RISK

open ↗

Referência

CVE-2023-5360

CVE-2023-5360—

Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

60RISK

open ↗

Referência

CVE-2019-6441

CVE-2019-6441—

An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM33

35RISK

open ↗

Referência✓ VexDay Proof

FAQ Manager 1.2 - 'header.php' Remote File Inclusion

CVE-2008-5288—webappsphp

PHP remote file inclusion vulnerability in include/header.php in Werner Hilversum FAQ Manager 1.2, when register_globals

23RISK

open ↗

Referência

CVE-2016-5734

CVE-2016-5734—

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to

60RISK

open ↗

Referência✓ VexDay Proof

Clean CMS 1.5 - Blind SQL Injection

CVE-2008-5289—webappsphp

SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting

CVE-2008-5289—webappsphp

SQL injection vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to execute arbitra

23RISK

open ↗

Referência

CVE-2018-5955

CVE-2018-5955—

An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unau

60RISK

open ↗

Referência✓ VexDay Proof

Clean CMS 1.5 - Blind SQL Injection / Cross-Site Scripting

CVE-2008-5290—webappsphp

Cross-site scripting (XSS) vulnerability in full_txt.php in Werner Hilversum Clean CMS 1.5 allows remote attackers to in

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.