Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2011-5049
CVE-2011-5049—
MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) vi
23RISK
open ↗
Referência
CVE-2021-42136
CVE-2021-42136—
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows
23RISK
open ↗
Referência
CVE-2019-10874
CVE-2019-10874—
Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to ex
23RISK
open ↗
Referência
CVE-2019-10874
CVE-2019-10874—
Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to ex
23RISK
open ↗
Referência✓ VexDay Proof
Rising AntiVirus Online Scanner - Insecure Method Flaw
CVE-2008-1116—remotewindows
Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner all
28RISK
open ↗
Referência✓ VexDay Proof
PunBB 1.2.16 - Blind Password Recovery
CVE-2008-1484—webappsphp
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which a
23RISK
open ↗
Referência✓ VexDay Proof
events Calendar 1.1 - Remote File Inclusion
CVE-2008-4673—webappsphp
PHP remote file inclusion vulnerability in panel/common/theme/default/header_setup.php in WebBiscuits Software Events Ca
23RISK
open ↗
Referência
CVE-2019-1125
CVE-2019-1125MEDIUM
Windows Kernel Information Disclosure Vulnerability
33RISK
open ↗
Referência✓ VexDay Proof
TorrentTrader Classic 1.09 - Multiple Vulnerabilities
CVE-2009-2160—webappsphp
TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpin
23RISK
open ↗
Referência
CVE-2018-17182
CVE-2018-17182—
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles
23RISK
open ↗
Referência
CVE-2021-27964
CVE-2021-27964—
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Con
50RISK
open ↗
Referência
CVE-2021-28164
CVE-2021-28164MEDIUM
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
70RISK
open ↗
Referência
CVE-2009-3597
CVE-2009-3597—
Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência
CVE-2012-4362
CVE-2012-4362—
hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a
23RISK
open ↗
Referência
CVE-2012-4362
CVE-2012-4362—
hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$a
23RISK
open ↗
Referência
CVE-2023-38951
CVE-2023-38951CRITICAL
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arb
48RISK
open ↗
Referência
CVE-2007-1524
CVE-2007-1524—
Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arb
23RISK
open ↗
Referência
CVE-2013-6233
CVE-2013-6233—
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web
23RISK
open ↗
Referência
CVE-2013-6233
CVE-2013-6233—
Cross-site scripting (XSS) vulnerability in SpagoBI before 4.1 allows remote authenticated users to inject arbitrary web
23RISK
open ↗
Referência✓ VexDay Proof
b1gbb 2.24.0 - SQL Injection / Cross-Site Scripting
CVE-2007-3590—webappsphp
Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-1494
CVE-2010-1494—
Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to re
43RISK
open ↗
Referência
CVE-2010-1494
CVE-2010-1494—
Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to re
43RISK
open ↗
Referência
CVE-2015-6811
CVE-2015-6811—
SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlie
23RISK
open ↗
Referência
CVE-2015-6811
CVE-2015-6811—
SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlie
23RISK
open ↗
Referência✓ VexDay Proof
phpGroupWare 0.9.16.010 - 'GLOBALS[]' Remote Code Execution
CVE-2006-4458—webappsphp
Directory traversal vulnerability in calendar/inc/class.holidaycalc.inc.php in phpGroupWare 0.9.16.010 and earlier allow
23RISK
open ↗
Referência
CVE-2015-2789
CVE-2015-2789—
Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.
23RISK
open ↗
Referência
CVE-2015-2789
CVE-2015-2789—
Unquoted Windows search path vulnerability in the Foxit Cloud Safe Update Service in the Cloud plugin in Foxit Reader 6.
23RISK
open ↗
Referência
CVE-2020-18724
CVE-2020-18724—
Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19
23RISK
open ↗
Referência
CVE-2024-10811
CVE-2024-10811CRITICAL
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Up
48RISK
open ↗
Referência
CVE-2023-0905
CVE-2023-0905HIGH
SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication
41RISK
open ↗
← previouspage 255 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.