Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
22,175 exploits
Referência
CVE-2014-4113
CVE-2014-4113HIGHunder attack
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a
100RISK
open ↗
Referência
CVE-2018-1002001
CVE-2018-1002001—
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗
Referência
CVE-2014-4113
CVE-2014-4113HIGHunder attack
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 a
100RISK
open ↗
Referência
CVE-2009-4154
CVE-2009-4154—
Directory traversal vulnerability in includes/feedcreator.class.php in Elxis CMS allows remote attackers to read arbitra
23RISK
open ↗
Referência✓ VexDay Proof
eNdonesia 8.4 - '/mod.php/friend.php/admin.php' Multiple Vulnerabilities
CVE-2006-6872—webappsphp
Directory traversal vulnerability in mod.php in eNdonesia 8.4 allows remote attackers to read arbitrary files via a .. (
23RISK
open ↗
Referência✓ VexDay Proof
Open Azimyt CMS 0.22 - 'lang' Local File Inclusion
CVE-2008-2820—webappsphp
Directory traversal vulnerability in lang/lang-system.php in Open Azimyt CMS 0.22 minimal and 0.21 stable allows remote
23RISK
open ↗
Referência✓ VexDay Proof
RoseOnlineCMS 3 beta2 - 'op' Local File Inclusion
CVE-2007-1636—webappsphp
Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files
23RISK
open ↗
Referência✓ VexDay Proof
Sepcity Classified - 'ID' SQL Injection
CVE-2008-6157—webappsasp
SepCity Classified Ads stores the admin password in cleartext in data/classifieds.mdb, which allows context-dependent at
23RISK
open ↗
Referência
CVE-2017-9130
CVE-2017-9130—
The faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 allows remote attackers to caus
23RISK
open ↗
Referência
CVE-2015-1054
CVE-2015-1054—
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to in
23RISK
open ↗
Referência
CVE-2015-1054
CVE-2015-1054—
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to in
23RISK
open ↗
Referência
CVE-2010-4998
CVE-2010-4998—
PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote
23RISK
open ↗
Referência
CVE-2010-4998
CVE-2010-4998—
PHP remote file inclusion vulnerability in ardeaCore/lib/core/ardeaInit.php in ardeaCore PHP Framework 2.2 allows remote
23RISK
open ↗
Referência
CVE-2010-1927
CVE-2010-1927—
Multiple PHP remote file inclusion vulnerabilities in openMairie openCourrier 2.02 and 2.03 beta, when register_globals
23RISK
open ↗
Referência
CVE-2010-1927
CVE-2010-1927—
Multiple PHP remote file inclusion vulnerabilities in openMairie openCourrier 2.02 and 2.03 beta, when register_globals
23RISK
open ↗
Referência
CVE-2018-5971
CVE-2018-5971—
SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array paramet
23RISK
open ↗
Referência
CVE-2014-4114
CVE-2014-4114HIGHunder attack
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
100RISK
open ↗
Referência
CVE-2010-3205
CVE-2010-3205—
PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2010-3205
CVE-2010-3205—
PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitra
23RISK
open ↗
Referência✓ VexDay Proof
Sendcard 3.4.1 - Local File Inclusion / Remote Code Execution
CVE-2007-3082—webappsphp
Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to include and e
23RISK
open ↗
Referência
CVE-2012-3350
CVE-2012-3350—
SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2017-13253
CVE-2017-13253—
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. Thi
23RISK
open ↗
Referência
CVE-2018-1002003
CVE-2018-1002003—
There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability re
23RISK
open ↗
Referência✓ VexDay Proof
db Software Laboratory VImpX - 'VImpX.ocx' Multiple Vulnerabilities
CVE-2008-4750—remotewindows
Stack-based buffer overflow in the VImpX.VImpAX ActiveX control (VImpX.ocx) 4.8.8.0 in DB Software Laboratory VImp X, po
23RISK
open ↗
Referência
CVE-2009-4434
CVE-2009-4434—
Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbi
23RISK
open ↗
Referência
CVE-2009-4434
CVE-2009-4434—
Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbi
23RISK
open ↗
Referência✓ VexDay Proof
Grestul 1.2 - Remote Add Administrator Account
CVE-2009-2040—webappsphp
admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authenticati
23RISK
open ↗
Referência
CVE-2009-4435
CVE-2009-4435—
Multiple directory traversal vulnerabilities in F3Site 2009 allow remote attackers to include and execute arbitrary loca
23RISK
open ↗
Referência
CVE-2010-1928
CVE-2010-1928—
Directory traversal vulnerability in scr/soustab.php in openMairie openPlanning 1.00, when register_globals is enabled,
23RISK
open ↗
Referência✓ VexDay Proof
FTP Voyager 14.0.0.3 - 'CWD' Remote Stack Overflow (PoC)
CVE-2007-1079—doswindows
Stack-based buffer overflow in Rhino Software, Inc. FTP Voyager 14.0.0.3 and earlier allows remote servers to cause a de
23RISK
open ↗
← previouspage 412 / 740next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.