Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2007-4503
SQL injection vulnerability in index.php in the Nice Talk component (com_nicetalk) 0.9.3 and earlier for Joomla! allows
23RISK
open ↗Referência
CVE-2009-2770
PowerUpload 2.4 allows remote attackers to bypass authentication and gain administrative access via a MIME encoded value
23RISK
open ↗Referência
CVE-2012-1671
Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and ex
23RISK
open ↗Referência
CVE-2010-3023
Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers t
23RISK
open ↗Referência
CVE-2012-5224
PHP remote file inclusion vulnerability in vb/includes/vba_cmps_include_bottom.php in vBadvanced CMPS 3.2.2 and earlier
23RISK
open ↗Referência
CVE-2014-10029
SQL injection vulnerability in profile.php in FluxBB before 1.4.13 and 1.5.x before 1.5.7 allows remote attackers to exe
23RISK
open ↗Referência
CVE-2017-11830
Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allow
23RISK
open ↗Referência✓ VexDay Proof
IceBB 1.0-rc5 - Remote Code Execution
Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitra
23RISK
open ↗Referência✓ VexDay Proof
AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete
js/pages/pages_data.php in AuraCMS 2.2 through 2.2.2 does not perform authentication, which allows remote attackers to a
23RISK
open ↗Referência✓ VexDay Proof
Crux Gallery 1.32 - Insecure Cookie Handling
main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name para
23RISK
open ↗Referência✓ VexDay Proof
Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion
PHP remote file inclusion vulnerability in show_joined.php in Indiscripts Enthusiast 3.1.4, and possibly earlier, allows
23RISK
open ↗Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Authentication Bypass
TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a dir
23RISK
open ↗Referência✓ VexDay Proof
ccTiddly 1.7.4 - 'cct_base' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitra
23RISK
open ↗Referência✓ VexDay Proof
AJ Auction - Authentication Bypass
AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when
23RISK
open ↗Referência
CVE-2010-2508
SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to exec
23RISK
open ↗Referência
CVE-2012-6643
Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow
23RISK
open ↗Referência
CVE-2010-2510
SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitra
23RISK
open ↗Referência
CVE-2010-2511
SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to e
23RISK
open ↗Referência
CVE-2013-5694
SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2013-5694
SQL injection vulnerability in status/service/acknowledge in Opsview before 4.4.1 allows remote attackers to execute arb
23RISK
open ↗Referência
CVE-2017-9979
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be t
23RISK
open ↗Referência
CVE-2017-9979
On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be t
23RISK
open ↗Referência
CVE-2009-5103
Cross-site scripting (XSS) vulnerability in ATCOM Netvolution 1.0 ASP allows remote attackers to inject arbitrary web sc
23RISK
open ↗Referência
CVE-2018-16156
In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes u
23RISK
open ↗Referência
CVE-2017-11823
The Microsoft Device Guard on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a security
23RISK
open ↗Referência✓ VexDay Proof
Explay CMS 2.1 - Insecure Cookie Handling
Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting th
23RISK
open ↗Referência✓ VexDay Proof
Vivvo Article Manager 3.2 - 'id' SQL Injection
SQL injection vulnerability in pdf_version.php in SpoonLabs Vivvo Article Management CMS (aka phpWordPress) 3.2 and earl
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eCoupons 1.0 - 'myprofile.asp' Remote Pass Change
myprofile.asp in Enthrallweb eCoupons does not properly validate the MM_recordId parameter during profile updates, which
23RISK
open ↗Referência✓ VexDay Proof
Stash 1.0.3 - Insecure Cookie Handling
admin/login.php in Stash 1.0.3 allows remote attackers to bypass authentication and gain administrative access by settin
23RISK
open ↗Referência✓ VexDay Proof
Enthrallweb eNews 1.0 - Remote User Pass Change
myprofile.asp in Enthrallweb eNews does not properly validate the MM_recordId parameter during profile updates, which al
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.