Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
21,497 exploits
Referência
CVE-2017-9418
CVE-2017-9418—
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute ar
23RISK
open ↗
Referência
CVE-2010-2908
CVE-2010-2908—
SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2010-2908
CVE-2010-2908—
SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2012-3836
CVE-2012-3836—
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrar
23RISK
open ↗
Referência
CVE-2012-5899
CVE-2012-5899—
Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
WebText 0.4.5.2 - Remote Code Execution
CVE-2006-6856—webappsphp
Direct static code injection vulnerability in WebText CMS 0.4.5.2 and earlier allows remote attackers to inject arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
FTP Explorer 1.0.1 Build 047 - Remote CPU Consumption (Denial of Service)
CVE-2007-1082—doswindows
FTP Explorer 1.0.1 Build 047, and other versions before 1.0.1.52, allows remote servers to cause a denial of service (CP
23RISK
open ↗
Referência✓ VexDay Proof
XCMS 1.1 - 'Galerie.php' Local File Inclusion
CVE-2007-3523—webappsphp
Multiple directory traversal vulnerabilities in Module/Galerie.php in XCMS 1.1 allow remote attackers to include and exe
23RISK
open ↗
Referência✓ VexDay Proof
MODx CMS 0.9.6.2 - Remote File Inclusion / Cross-Site Scripting
CVE-2008-5938—webappsphp
PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier,
23RISK
open ↗
Referência✓ VexDay Proof
AJSquare Free Polling Script - 'DB' Multiple Vulnerabilities
CVE-2008-7045—webappsphp
AJ Square Free Polling Script (AJPoll) Database version allows remote attackers to bypass authentication and reset poll
23RISK
open ↗
Referência✓ VexDay Proof
PHPortal 1.0 - Insecure Cookie Handling
CVE-2009-2117—webappsphp
uye_paneli.php in phPortal 1.0 allows remote attackers to bypass authentication and obtain administrative access by sett
23RISK
open ↗
Referência
CVE-2012-2588
CVE-2012-2588—
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitr
23RISK
open ↗
Referência
CVE-2022-41073
CVE-2022-41073HIGHunder attackransomware
Windows Print Spooler Elevation of Privilege Vulnerability
71RISK
open ↗
Referência
CVE-2010-2910
CVE-2010-2910—
SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2010-2910
CVE-2010-2910—
SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2013-5117
CVE-2013-5117—
SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNu
23RISK
open ↗
Referência
CVE-2010-2912
CVE-2010-2912—
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-2912
CVE-2010-2912—
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2009-3542
CVE-2009-3542—
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to incl
23RISK
open ↗
Referência
CVE-2022-23366
CVE-2022-23366—
HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.
23RISK
open ↗
Referência
CVE-2022-23513
CVE-2022-23513MEDIUM
Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
45RISK
open ↗
Referência
CVE-2010-4924
CVE-2010-4924—
PHP remote file inclusion vulnerability in logic/controller.class.php in clearBudget 0.9.8 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2018-18794
CVE-2018-18794—
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISK
open ↗
Referência
CVE-2018-18794
CVE-2018-18794—
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISK
open ↗
Referência
CVE-2022-23642
CVE-2022-23642HIGH
Code Injection in Sourcegraph
78RISK
open ↗
Referência
CVE-2018-12739
CVE-2018-12739—
In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.
23RISK
open ↗
Referência
CVE-2012-4262
CVE-2012-4262—
Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2012-4262
CVE-2012-4262—
Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2018-6023
CVE-2018-6023—
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act
23RISK
open ↗
Referência
CVE-2018-6023
CVE-2018-6023—
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act
23RISK
open ↗
← previouspage 176 / 717next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.