Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2015-8356
CVE-2015-8356—
Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u
23RISK
open ↗
Referência
CVE-2012-3236
CVE-2012-3236—
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic
28RISK
open ↗
Referência
CVE-2013-1616
CVE-2013-1616—
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbit
28RISK
open ↗
Referência
CVE-2007-3806
CVE-2007-3806—
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbi
28RISK
open ↗
Referência
CVE-2013-3530
CVE-2013-3530—
SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
NaviCOPA Web Server 2.01 - Remote Buffer Overflow (Metasploit)
CVE-2007-1733—remotewindows
Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (
28RISK
open ↗
Referência✓ VexDay Proof
eCentrex VOIP Client module - 'uacomx.ocx 2.0.1' Remote Buffer Overflow
CVE-2007-4489—remotewindows
Buffer overflow in the IUAComFormX ActiveX control in uacomx.ocx 2.0.1 in the eCentrex VOIP Client module allows remote
23RISK
open ↗
Referência✓ VexDay Proof
Sejoong Namo ActiveSquare 6 - 'NamoInstaller.dll' ActiveX Buffer Overflow
CVE-2008-0634—remotewindows
Buffer overflow in the NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1, as used in Sejoong Namo
23RISK
open ↗
Referência✓ VexDay Proof
IntelliTamper 2.07 - 'imgsrc' Remote Buffer Overflow
CVE-2008-3583—remotewindows
Buffer overflow in the HTML parser in IntelliTamper 2.07 allows remote attackers to execute arbitrary code via a long UR
23RISK
open ↗
Referência✓ VexDay Proof
dotCMS 1.6 - 'id' Local File Inclusion
CVE-2008-3708—webappsphp
Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência✓ VexDay Proof
Advanced Electron Forum 1.0.6 - Remote Code Execution
CVE-2008-5090—webappsphp
Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code em
23RISK
open ↗
Referência
CVE-2010-1314
CVE-2010-1314—
Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote a
43RISK
open ↗
Referência
CVE-2010-1314
CVE-2010-1314—
Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote a
43RISK
open ↗
Referência
CVE-2010-1315
CVE-2010-1315—
Directory traversal vulnerability in weberpcustomer.php in the webERPcustomer (com_weberpcustomer) component 1.2.1 and 1
38RISK
open ↗
Referência
CVE-2010-1340
CVE-2010-1340—
Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2014-6619
CVE-2014-6619—
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Referência
CVE-2014-6619
CVE-2014-6619—
Multiple cross-site scripting (XSS) vulnerabilities in register-exec.php in Restaurant Script (PizzaInn_Project) 1.0.0 a
23RISK
open ↗
Referência
CVE-2019-8937
CVE-2019-8937—
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗
Referência
CVE-2019-8937
CVE-2019-8937—
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2014-2586
CVE-2014-2586—
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote atta
23RISK
open ↗
Referência
CVE-2006-6566
CVE-2006-6566—
PHP remote file inclusion vulnerability in includes/profilcp_constants.php in the Profile Control Panel (CPanel) module
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-9580
CVE-2014-9580—
Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2014-4710
CVE-2014-4710—
Cross-site scripting (XSS) vulnerability in zero_user_account.php in ZeroCMS 1.0 allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-7368
CVE-2013-7368—
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2013-5312
CVE-2013-5312—
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-5312
CVE-2013-5312—
Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2013-4898
CVE-2013-4898—
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine
23RISK
open ↗
← previouspage 249 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.