Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2017-6427
CVE-2017-6427—
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will ca
23RISK
open ↗
Referência✓ VexDay Proof
Simple HTTPd 1.41 - '/aux' Remote Denial of Service
CVE-2007-6326—doswindows
Sergey Lyubka Simple HTTPD (shttpd) 1.3 on Windows allows remote attackers to cause a denial of service via a request th
23RISK
open ↗
Referência
CVE-2017-0118
CVE-2017-0118—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
28RISK
open ↗
Referência
CVE-2009-2362
CVE-2009-2362—
Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long
23RISK
open ↗
Referência
CVE-2009-2362
CVE-2009-2362—
Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long
23RISK
open ↗
Referência
Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation
CVE-2024-38193HIGHunder attacklocalwindows
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
76RISK
open ↗
Referência✓ VexDay Proof
My Gaming Ladder 7.5 - 'ladderid' SQL Injection
CVE-2008-1791—webappsphp
SQL injection vulnerability in ladder.php in My Gaming Ladder 7.5 and earlier allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2018-12522
CVE-2018-12522—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ pro
23RISK
open ↗
Referência
CVE-2013-4885
CVE-2013-4885—
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote s
23RISK
open ↗
Referência
CVE-2017-15879
CVE-2017-15879—
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
23RISK
open ↗
Referência
CVE-2017-15879
CVE-2017-15879—
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCS
23RISK
open ↗
Referência
CVE-2017-7046
CVE-2017-7046—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência✓ VexDay Proof
PPStream - 'PowerPlayer.dll 2.0.1.3829' ActiveX Remote Overflow
CVE-2007-4748—remotewindows
Buffer overflow in the PowerPlayer.dll ActiveX control in PPStream 2.0.1.3829 allows remote attackers to execute arbitra
23RISK
open ↗
Referência
CVE-2022-40319
CVE-2022-40319HIGH
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a
41RISK
open ↗
Referência
CVE-2018-10255
CVE-2018-10255—
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level pri
23RISK
open ↗
Referência
CVE-2018-10255
CVE-2018-10255—
A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level pri
23RISK
open ↗
Referência
CVE-2009-3355
CVE-2009-3355—
Cross-site scripting (XSS) vulnerability in profile.php in Datetopia Buy Dating Site 1.0 allows remote attackers to inje
23RISK
open ↗
Referência✓ VexDay Proof
Dragoon 0.1 - 'lng' Local File Inclusion
CVE-2008-1798—webappsphp
Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include a
23RISK
open ↗
Referência
CVE-2017-6359
CVE-2017-6359—
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
28RISK
open ↗
Referência
CVE-2010-4055
CVE-2010-4055—
Stack consumption vulnerability in solid.exe in IBM solidDB 6.5.0.3 and earlier allows remote attackers to cause a denia
23RISK
open ↗
Referência
CVE-2010-4057
CVE-2010-4057—
solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon recei
23RISK
open ↗
Referência
CVE-2014-9350
CVE-2014-9350—
TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attack
23RISK
open ↗
Referência
CVE-2014-9350
CVE-2014-9350—
TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attack
23RISK
open ↗
Referência
CVE-2012-0292
CVE-2012-0292—
The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.
23RISK
open ↗
Referência
CVE-2014-3418
CVE-2014-3418—
config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via she
23RISK
open ↗
Referência
CVE-2009-3356
CVE-2009-3356—
SQL injection vulnerability in index.php in Image voting 1.0 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Referência
CVE-2015-5533
CVE-2015-5533—
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote
23RISK
open ↗
Referência
CVE-2015-5533
CVE-2015-5533—
SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote
23RISK
open ↗
Referência
CVE-2021-21276
CVE-2021-21276CRITICAL
Privilege escalation in Polr
48RISK
open ↗
Referência
CVE-2016-15048
CVE-2016-15048CRITICAL
AMTT HiBOS Command Injection RCE via server_ping.php
48RISK
open ↗
← previouspage 447 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.