Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2015-2291
CVE-2015-2291HIGHunder attackransomware
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all
71RISK
open ↗
Referência✓ VexDay Proof
WMNews 0.2a - 'base_datapath' Remote File Inclusion
CVE-2006-3928—webappsphp
PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2017-5631
CVE-2017-5631—
An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr"
38RISK
open ↗
Referência
CVE-2012-6534
CVE-2012-6534—
Novell Sentinel Log Manager before 1.2.0.3 allows remote attackers to create data retention policies via a crafted text/
23RISK
open ↗
Referência
CVE-2020-1027
CVE-2020-1027HIGHunder attack
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Window
71RISK
open ↗
Referência✓ VexDay Proof
Dyncms Release 6 - 'x_admindir' Remote File Inclusion
CVE-2006-4589—webappsphp
PHP remote file inclusion vulnerability in 0_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows
23RISK
open ↗
Referência
CVE-2018-19799
CVE-2018-19799—
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
23RISK
open ↗
Referência
CVE-2018-19799
CVE-2018-19799—
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.
23RISK
open ↗
Referência
CVE-2022-21723
CVE-2022-21723CRITICAL
Out-of-bounds read in multipart parsing in PJSIP
48RISK
open ↗
Referência
CVE-2019-7273
CVE-2019-7273—
Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF).
23RISK
open ↗
Referência
CVE-2023-31703
CVE-2023-31703CRITICAL
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allo
48RISK
open ↗
Referência✓ VexDay Proof
hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities
CVE-2007-6500—webappsasp
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to delete
23RISK
open ↗
Referência
CVE-2018-20782
CVE-2018-20782—
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
28RISK
open ↗
Referência
CVE-2010-1535
CVE-2010-1535—
Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers
43RISK
open ↗
Referência
CVE-2021-28379
CVE-2021-28379—
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allow
23RISK
open ↗
Referência
CVE-2013-2474
CVE-2013-2474—
Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' paramete
28RISK
open ↗
Referência
CVE-2013-0238
CVE-2013-0238—
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allo
23RISK
open ↗
Referência
CVE-2015-2291
CVE-2015-2291HIGHunder attackransomware
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all
71RISK
open ↗
Referência
CVE-2018-7538
CVE-2018-7538—
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 a
23RISK
open ↗
Referência✓ VexDay Proof
Hewlett Packard 1.0.0.309 - 'hpqvwocx.dll' ActiveX Magview Overflow (PoC)
CVE-2007-2656—doswindows
Stack-based buffer overflow in the Hewlett-Packard (HP) Magview ActiveX control in hpqvwocx.dll 1.0.0.309 allows remote
23RISK
open ↗
Referência
CVE-2016-9351
CVE-2016-9351—
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error
23RISK
open ↗
Referência✓ VexDay Proof
NVR SP2 2.0 'nvUnifiedControl.dll 1.1.45.0' - 'SetText()' Command Execution
CVE-2007-4582—remotewindows
Buffer overflow in the nvUnifiedControl.AUnifiedControl.1 ActiveX control in nvUnifiedControl.dll 1.1.45.0 in ACTi Netwo
23RISK
open ↗
Referência✓ VexDay Proof
WebSVN 2.0 - Cross-Site Scripting / File Handling / Code Execution
CVE-2008-5918—webappsphp
Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier
23RISK
open ↗
Referência
CVE-2020-7934
CVE-2020-7934—
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyA
23RISK
open ↗
Referência
CVE-2010-1538
CVE-2010-1538—
SQL injection vulnerability in print_raincheck.php in phpRAINCHECK 1.0.1 and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2010-1538
CVE-2010-1538—
SQL injection vulnerability in print_raincheck.php in phpRAINCHECK 1.0.1 and earlier allows remote attackers to execute
23RISK
open ↗
Referência
CVE-2015-2182
CVE-2015-2182—
Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2015-2182
CVE-2015-2182—
Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script
23RISK
open ↗
Referência
CVE-2014-5464
CVE-2014-5464—
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
23RISK
open ↗
Referência
CVE-2014-5464
CVE-2014-5464—
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al
23RISK
open ↗
← previouspage 256 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.