Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,652cataloged exploits
34,545CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,581GitHub PoC 13,708VulnCheck XDB 8,225Nuclei 4,228Metasploit 3,467✓ verified onlyrecentpopularrisk
21,581 exploits
Referência
CVE-2018-4090
CVE-2018-4090—
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS
23RISK
open ↗
Referência
CVE-2019-19230
CVE-2019-19230CRITICAL
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component th
48RISK
open ↗
Referência
CVE-2015-3933
CVE-2015-3933—
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote
23RISK
open ↗
Referência
CVE-2015-5066
CVE-2015-5066—
Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2015-5066
CVE-2015-5066—
Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject ar
23RISK
open ↗
Referência
CVE-2019-1148
CVE-2019-1148MEDIUM
Microsoft Graphics Component Information Disclosure Vulnerability
33RISK
open ↗
Referência
CVE-2007-2792
CVE-2007-2792—
SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 f
23RISK
open ↗
Referência
CVE-2007-2792
CVE-2007-2792—
SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com_yanc) component before 1.5 beta 3 f
23RISK
open ↗
Referência✓ VexDay Proof
PHPRecipeBook 2.35 - 'g_rb_basedir' Remote File Inclusion
CVE-2006-5399—webappsphp
PHP remote file inclusion vulnerability in classes/Import_MM.class.php in PHPRecipeBook 2.36, when register_globals is e
23RISK
open ↗
Referência✓ VexDay Proof
Mambo Component MiniBB 1.5a - Remote File Inclusion
CVE-2006-3690—webappsphp
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier allow remote attackers to execute ar
23RISK
open ↗
Referência✓ VexDay Proof
MyAlbum 3.02 - 'language.inc.php' Remote File Inclusion
CVE-2006-5865—webappsphp
PHP remote file inclusion vulnerability in language.inc.php in MyAlbum 3.02 and earlier allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2020-15038
CVE-2020-15038—
The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
23RISK
open ↗
Referência
CVE-2008-3164
CVE-2008-3164—
Directory traversal vulnerability in blog.php in fuzzylime (cms) 3.01, when magic_quotes_gpc is disabled, allows remote
23RISK
open ↗
Referência✓ VexDay Proof
PHP recommend 1.3 - Authentication Bypass / Remote File Inclusion / Code Injection
CVE-2009-1780—webappsphp
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, wh
23RISK
open ↗
Referência
CVE-2021-31152
CVE-2021-31152—
Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can ena
23RISK
open ↗
Referência
CVE-2012-0782
CVE-2012-0782—
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPr
23RISK
open ↗
Referência
CVE-2020-28091
CVE-2020-28091—
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parame
23RISK
open ↗
Referência
CVE-2022-27412
CVE-2022-27412—
Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.
23RISK
open ↗
Referência
CVE-2007-6752
CVE-2007-6752—
Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authent
23RISK
open ↗
Referência
CVE-2007-6752
CVE-2007-6752—
Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authent
23RISK
open ↗
Referência
CVE-2012-2579
CVE-2012-2579—
Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attacke
23RISK
open ↗
Referência
CVE-2012-5346
CVE-2012-5346—
Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote atta
23RISK
open ↗
Referência
CVE-2012-5229
CVE-2012-5229—
Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows re
23RISK
open ↗
Referência
CVE-2012-2917
CVE-2012-2917—
Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to
23RISK
open ↗
Referência
CVE-2017-9429
CVE-2017-9429—
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitra
23RISK
open ↗
Referência
CVE-2015-4064
CVE-2015-4064—
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo
23RISK
open ↗
Referência
CVE-2015-4064
CVE-2015-4064—
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo
23RISK
open ↗
Referência
CVE-2015-4018
CVE-2015-4018—
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for W
23RISK
open ↗
Referência
CVE-2015-4018
CVE-2015-4018—
SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for W
23RISK
open ↗
Referência
CVE-2017-11494
CVE-2017-11494—
SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
← previouspage 241 / 720next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.