Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
22,166 exploits
Referência
CVE-2014-4155
CVE-2014-4155—
Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows rem
23RISK
open ↗
Referência
CVE-2011-5284
CVE-2011-5284—
Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothw
23RISK
open ↗
Referência
CVE-2011-5284
CVE-2011-5284—
Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothw
23RISK
open ↗
Referência
CVE-2013-5316
CVE-2013-5316—
Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of
23RISK
open ↗
Referência
CVE-2013-5316
CVE-2013-5316—
Cross-site request forgery (CSRF) vulnerability in RiteCMS 1.0.0 allows remote attackers to hijack the authentication of
23RISK
open ↗
Referência
CVE-2013-2754
CVE-2013-2754—
Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hij
23RISK
open ↗
Referência
CVE-2013-2754
CVE-2013-2754—
Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hij
23RISK
open ↗
Referência
CVE-2018-6936
CVE-2018-6936—
Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
23RISK
open ↗
Referência
CVE-2016-4534
CVE-2016-4534—
The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on W
23RISK
open ↗
Referência
CVE-2016-4534
CVE-2016-4534—
The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on W
23RISK
open ↗
Referência
CVE-2014-10001
CVE-2014-10001—
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attacker
23RISK
open ↗
Referência
CVE-2014-10001
CVE-2014-10001—
Multiple cross-site request forgery (CSRF) vulnerabilities in PHPJabbers Appointment Scheduler 2.0 allow remote attacker
23RISK
open ↗
Referência
CVE-2018-11581
CVE-2018-11581—
Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web s
23RISK
open ↗
Referência
CVE-2023-3184
CVE-2023-3184LOW
SourceCodester Sales Tracker Management System cross site scripting
28RISK
open ↗
Referência✓ VexDay Proof
ScriptMagix Jokes 2.0 - 'index.php?catid' SQL Injection
CVE-2007-1615—webappsphp
SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Prozilla Reviews Script 1.0 - Arbitrary Delete User
CVE-2008-1783—webappsphp
Prozilla Reviews 1.0 allows remote attackers to delete arbitrary users via a modified UserID parameter in a direct reque
23RISK
open ↗
Referência✓ VexDay Proof
Meto Forum 1.1 - Multiple SQL Injections
CVE-2008-2448—webappsasp
Multiple SQL injection vulnerabilities in Meto Forum 1.1 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência✓ VexDay Proof
Sisplet CMS 2008-01-24 - 'id' SQL Injection
CVE-2008-3026—webappsphp
SQL injection vulnerability in index.php in OneClick CMS (aka Sisplet CMS) 2008-01-24 allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
CMS MAXSITE Component Guestbook - Remote Command Execution
CVE-2008-6446—webappsphp
Static code injection vulnerability in the Guestbook component in CMS MAXSITE allows remote attackers to inject arbitrar
23RISK
open ↗
Referência✓ VexDay Proof
MauryCMS 0.53.2 - Arbitrary File Upload
CVE-2008-6952—webappsphp
SQL injection vulnerability in Rss.php in MauryCMS 0.53.2 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2009-2337
CVE-2009-2337—
SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when mag
23RISK
open ↗
Referência
CVE-2011-5218
CVE-2011-5218—
SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência
CVE-2019-2721
CVE-2019-2721—
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗
Referência
CVE-2009-2606
CVE-2009-2606—
ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows rem
23RISK
open ↗
Referência
CVE-2009-2602
CVE-2009-2602—
R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, whi
23RISK
open ↗
Referência
CVE-2018-25427
CVE-2018-25427CRITICAL
Arm Whois 3.11 Buffer Overflow via SEH Overwrite
48RISK
open ↗
Referência
CVE-2009-4545
CVE-2009-4545—
Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote
23RISK
open ↗
Referência
CVE-2022-47870
CVE-2022-47870MEDIUM
A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows r
33RISK
open ↗
Referência
CVE-2010-0725
CVE-2010-0725—
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2010-0725
CVE-2010-0725—
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary
23RISK
open ↗
← previouspage 391 / 739next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.