Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits

35,420CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência

CVE-2016-7255

CVE-2016-7255HIGHunder attack

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,

93RISK

open ↗

Referência

CVE-2016-7255

CVE-2016-7255HIGHunder attack

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,

93RISK

open ↗

Referência

CVE-2016-8810

CVE-2016-8810—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência

CVE-2021-44529

CVE-2021-44529CRITICALunder attackransomware

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

100RISK

open ↗

Referência

CVE-2021-44529

CVE-2021-44529CRITICALunder attackransomware

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

100RISK

open ↗

Referência

CVE-2021-44596

CVE-2021-44596—

Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an

28RISK

open ↗

Referência

Online Magazine Management System 1.0 - SQLi Authentication Bypass

CVE-2021-44653—webappsphp

Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel auth

23RISK

open ↗

Referência

Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass

CVE-2021-44655—webappsphp

Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. A

23RISK

open ↗

Referência

CVE-2021-44848

CVE-2021-44848—

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reques

43RISK

open ↗

Referência

CVE-2021-45092

CVE-2021-45092—

Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection vi

50RISK

open ↗

Referência

CVE-2021-46379

CVE-2021-46379—

DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrust

43RISK

open ↗

Referência

CVE-2021-46398

CVE-2021-46398—

A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor use

23RISK

open ↗

Referência

CVE-2022-23513

CVE-2022-23513MEDIUM

Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint

45RISK

open ↗

Referência

CVE-2022-23642

CVE-2022-23642HIGH

Code Injection in Sourcegraph

78RISK

open ↗

Referência

CVE-2022-23642

CVE-2022-23642HIGH

Code Injection in Sourcegraph

78RISK

open ↗

Referência

CVE-2022-24112

CVE-2022-24112CRITICALunder attack

apisix/batch-requests plugin allows overwriting the X-REAL-IP header

100RISK

open ↗

Referência

CVE-2022-24637

CVE-2022-24637—

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh

60RISK

open ↗

Referência

CVE-2022-24637

CVE-2022-24637—

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh

60RISK

open ↗

Referência

CVE-2022-26134

CVE-2022-26134CRITICALunder attackransomware

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

Referência

CVE-2017-15968

CVE-2017-15968—

MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.

23RISK

open ↗

Referência

CVE-2017-16542

CVE-2017-16542—

Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name param

23RISK

open ↗

Referência

CVE-2017-16777

CVE-2017-16777—

If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a loc

23RISK

open ↗

Referência

CVE-2017-16836

CVE-2017-16836—

Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via

23RISK

open ↗

Referência

CVE-2017-17571

CVE-2017-17571—

FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.

23RISK

open ↗

Referência

CVE-2022-30519

CVE-2022-30519MEDIUM

XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary c

33RISK

open ↗

Referência

CVE-2022-30525

CVE-2022-30525CRITICALunder attack

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat

100RISK

open ↗

Referência

CVE-2022-30781

CVE-2022-30781—

Gitea before 1.16.7 does not escape git fetch remote.

60RISK

open ↗

Referência

CVE-2022-30781

CVE-2022-30781—

Gitea before 1.16.7 does not escape git fetch remote.

60RISK

open ↗

Referência

CVE-2022-31188

CVE-2022-31188HIGH

Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

53RISK

open ↗

Referência

CVE-2022-32272

CVE-2022-32272—

OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.