Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits

34,478CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecent popular risk

21,497 exploits

Referência

CVE-2012-2376

CVE-2012-2376—

Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execut

28RISK

open ↗

Referência

CVE-2015-0555

CVE-2015-0555—

Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote

23RISK

open ↗

Referência✓ VexDay Proof

Really Simple PHP and Ajax (RSPA) 2007-03-23 - Remote File Inclusion

CVE-2007-1851—webappsphp

Multiple directory traversal vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 allow remote attackers to i

23RISK

open ↗

Referência

CVE-2025-15501

CVE-2025-15501CRITICAL

Sangfor Operation and Maintenance Management System getCmd WriterHandle.getCmd os command injection

48RISK

open ↗

Referência

CVE-2023-0744

CVE-2023-0744CRITICAL

Improper Access Control in answerdev/answer

48RISK

open ↗

Referência

CVE-2011-5172

CVE-2011-5172—

Stack-based buffer overflow in StoryBoard Quick 6 Build 3786, and possibly StoryBoard Artist and StoryBoard Studio, allo

23RISK

open ↗

Referência✓ VexDay Proof

phpChess Community Edition 2.0 - Multiple Remote File Inclusions

CVE-2007-2677—webappsphp

Multiple PHP remote file inclusion vulnerabilities in phpChess Community Edition 2.0 allow remote attackers to execute a

23RISK

open ↗

Referência✓ VexDay Proof

LightBlog 9.5 - 'cp_upload_image.php' Arbitrary File Upload

CVE-2008-0632—webappsphp

Unrestricted file upload vulnerability in cp_upload_image.php in LightBlog 9.5 allows remote attackers to execute arbitr

23RISK

open ↗

Referência✓ VexDay Proof

VBA32 Personal AntiVirus 3.12.8.x - Malformed Archive Denial of Service

CVE-2008-5667—doswindows

The scanning engine in VirusBlokAda VBA32 Personal Antivirus 3.12.8.x allows remote attackers to cause a denial of servi

23RISK

open ↗

Referência

CVE-2018-7466

CVE-2018-7466—

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging c

23RISK

open ↗

Referência

CVE-2018-7466

CVE-2018-7466—

install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging c

23RISK

open ↗

Referência

CVE-2020-27423

CVE-2020-27423—

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial o

23RISK

open ↗

Referência

CVE-2019-8391

CVE-2019-8391—

qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.

23RISK

open ↗

Referência

CVE-2014-9208

CVE-2014-9208—

Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attacker

23RISK

open ↗

Referência

CVE-2012-0025

CVE-2012-0025—

Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the Fla

23RISK

open ↗

Referência

CVE-2010-0758

CVE-2010-0758—

SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2010-0758

CVE-2010-0758—

SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2016-4273

CVE-2016-4273—

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637

28RISK

open ↗

Referência

CVE-2009-3643

CVE-2009-3643—

Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to th

23RISK

open ↗

Referência

CVE-2013-1463

CVE-2013-1463—

Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4

23RISK

open ↗

Referência

CVE-2019-8927

CVE-2019-8927—

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon

23RISK

open ↗

Referência

CVE-2019-8927

CVE-2019-8927—

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon

23RISK

open ↗

Referência

CVE-2013-2682

CVE-2013-2682—

Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain

23RISK

open ↗

Referência✓ VexDay Proof

Quintessential Player 4.50.1.82 - Playlist Denial of Service (PoC)

CVE-2006-6261—doswindows

Buffer overflow in Quintessential Player 4.50.1.82 and earlier allows remote attackers to cause a denial of service (cra

23RISK

open ↗

Referência✓ VexDay Proof

ActiveKB 1.5 - Insecure Cookie Handling/Arbitrary Admin Access

CVE-2008-2338—webappsphp

Interspire ActiveKB 1.5 and earlier allows remote attackers to gain privileges by setting the auth cookie to true when a

23RISK

open ↗

Referência✓ VexDay Proof

MapLab MS4W 2.2.1 - Remote File Inclusion

CVE-2007-1843—webappsphp

PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register_globals is enabled, all

23RISK

open ↗

Referência✓ VexDay Proof

MySpace Content Zone 3.x - Arbitrary File Upload

CVE-2007-6668—webappsphp

admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote

23RISK

open ↗

Referência✓ VexDay Proof

CodeAvalanche Directory - Database Disclosure

CVE-2008-5898—webappsasp

CodeAvalanche Directory stores sensitive information under the web root with insufficient access control, which allows r

23RISK

open ↗

Referência✓ VexDay Proof

CodeAvalanche FreeWallpaper - Remote Database Disclosure

CVE-2008-5897—webappsasp

CodeAvalanche FreeWallpaper stores sensitive information under the web root with insufficient access control, which allo

23RISK

open ↗

Referência✓ VexDay Proof

ReVou Twitter Clone - Admin Password Change

CVE-2008-6752—webappsphp

adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original passw

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.