Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,652cataloged exploits

34,545CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,581GitHub PoC 13,708VulnCheck XDB 8,225Nuclei 4,228Metasploit 3,467✓ verified onlyrecent popular risk

21,554 exploits

Referência

CVE-2009-3597

CVE-2009-3597—

Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows rem

23RISK

open ↗

Referência

CVE-2012-4362

CVE-2012-4362—

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a

23RISK

open ↗

Referência

CVE-2012-4362

CVE-2012-4362—

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a

23RISK

open ↗

Referência

CVE-2023-38951

CVE-2023-38951CRITICAL

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arb

48RISK

open ↗

Referência

CVE-2007-1524

CVE-2007-1524—

Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arb

23RISK

open ↗

Referência

CVE-2013-6233

CVE-2013-6233—

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web

23RISK

open ↗

Referência

CVE-2013-6233

CVE-2013-6233—

Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web

23RISK

open ↗

Referência✓ VexDay Proof

b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting

CVE-2007-3590—webappsphp

Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2010-1494

CVE-2010-1494—

Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to re

43RISK

open ↗

Referência

CVE-2010-1494

CVE-2010-1494—

Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to re

43RISK

open ↗

Referência

CVE-2015-6811

CVE-2015-6811—

SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlie

23RISK

open ↗

Referência

CVE-2015-6811

CVE-2015-6811—

SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlie

23RISK

open ↗

Referência✓ VexDay Proof

phpGroupWare 0.9.16.010 - 'GLOBALS[]' Remote Code Execution

CVE-2006-4458—webappsphp

Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allow

23RISK

open ↗

Referência

CVE-2015-2789

CVE-2015-2789—

Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.

23RISK

open ↗

Referência

CVE-2015-2789

CVE-2015-2789—

Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.

23RISK

open ↗

Referência

CVE-2020-18724

CVE-2020-18724—

Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19

23RISK

open ↗

Referência

CVE-2024-10811

CVE-2024-10811CRITICAL

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up

48RISK

open ↗

Referência

CVE-2023-0905

CVE-2023-0905HIGH

SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication

41RISK

open ↗

Referência

CVE-2025-34187

CVE-2025-34187CRITICAL

Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

48RISK

open ↗

Referência

CVE-2025-34187

CVE-2025-34187CRITICAL

Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

48RISK

open ↗

Referência

CVE-2018-13989

CVE-2018-13989—

Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable

23RISK

open ↗

Referência

CVE-2018-13989

CVE-2018-13989—

Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable

23RISK

open ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISK

open ↗

Referência

CVE-2018-7318

CVE-2018-7318—

SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, descrip

23RISK

open ↗

Referência✓ VexDay Proof

Quicksilver Forums 1.4.2 (Windows) - Remote Code Execution

CVE-2008-7064—webappsphp

Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as use

23RISK

open ↗

Referência✓ VexDay Proof

webSPELL 4.2.0e - 'page' Blind SQL Injection

CVE-2009-1912—webappsphp

Directory traversal vulnerability in src/func/language.php in webSPELL 4.2.0e and earlier allows remote attackers to inc

23RISK

open ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISK

open ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISK

open ↗

Referência

CVE-2012-10059

CVE-2012-10059CRITICAL

Dolibarr ERP/CRM Post-Auth OS Command Injection

63RISK

open ↗

Referência

CVE-2018-0880

CVE-2018-0880—

The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.