Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
21,534 exploits
Referência
CVE-2010-1315
CVE-2010-1315—
Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1
38RISK
open ↗
Referência
CVE-2010-1340
CVE-2010-1340—
Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2014-6619
CVE-2014-6619—
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Referência
CVE-2014-6619
CVE-2014-6619—
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Referência
CVE-2019-8937
CVE-2019-8937—
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗
Referência
CVE-2019-8937
CVE-2019-8937—
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2006-6566
CVE-2006-6566—
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-7368
CVE-2013-7368—
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2013-5312
CVE-2013-5312—
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-5312
CVE-2013-5312—
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-4898
CVE-2013-4898—
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine
23RISK
open ↗
Referência✓ VexDay Proof
RevilloC MailServer 1.x - 'RCPT TO' Remote Denial of Service
CVE-2006-5552—doswindows
Multiple heap-based buffer overflows in RevilloC MailServer 1.21 and earlier allow remote attackers to cause a denial of
23RISK
open ↗
Referência✓ VexDay Proof
OpenH323 Opal SIP Protocol - Remote Denial of Service
CVE-2007-4924—doswindows
The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remo
28RISK
open ↗
Referência
CVE-2014-9349
CVE-2014-9349—
Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2014-9349
CVE-2014-9349—
Multiple cross-site scripting (XSS) vulnerabilities in admin/robots.lib.php in RobotStats 1.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2010-1341
CVE-2010-1341—
SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2018-12520
CVE-2018-12520—
An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG involved in the generation of session IDs is not seede
28RISK
open ↗
Referência
CVE-2012-0407
CVE-2012-0407—
Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote att
23RISK
open ↗
Referência
CVE-2015-5999
CVE-2015-5999—
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2
23RISK
open ↗
Referência
CVE-2015-5999
CVE-2015-5999—
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2
23RISK
open ↗
Referência✓ VexDay Proof
SysInfo 1.21 - 'sysinfo.cgi' Remote Command Execution
CVE-2006-1832—webappscgi
sysinfo.cgi in sysinfo 1.21 allows remote attackers to obtain the installation path via the debugger action.
23RISK
open ↗
Referência
CVE-2019-1010124
CVE-2019-1010124—
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to
23RISK
open ↗
Referência✓ VexDay Proof
Lms 1.8.9 - Vala Remote File Inclusion
CVE-2007-1643—webappsphp
Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote at
28RISK
open ↗
Referência
CVE-2018-17376
CVE-2018-17376—
SQL Injection exists in the Reverse Auction Factory 4.3.8 component for Joomla! via the filter_order_Dir, cat, or filter
23RISK
open ↗
← previouspage 194 / 718next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.