Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits

35,469CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência

CVE-2022-36446

CVE-2022-36446—

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

60RISK

open ↗

Referência

CVE-2022-36446

CVE-2022-36446—

software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.

60RISK

open ↗

Referência

CVE-2022-37061

CVE-2022-37061—

All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This

60RISK

open ↗

Referência

CVE-2017-17598

CVE-2017-17598—

Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.

23RISK

open ↗

Referência

CVE-2017-17617

CVE-2017-17617—

Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.

23RISK

open ↗

Referência

CVE-2022-40946

CVE-2022-40946HIGH

On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via t

41RISK

open ↗

Referência

CVE-2022-41358

CVE-2022-41358MEDIUM

A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary

33RISK

open ↗

Referência

CVE-2022-41413

CVE-2022-41413MEDIUM

perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attack

33RISK

open ↗

Referência

CVE-2022-42889

CVE-2022-42889—

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

60RISK

open ↗

Referência

CVE-2017-17636

CVE-2017-17636—

MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.

23RISK

open ↗

Referência

CVE-2017-17636

CVE-2017-17636—

MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.

23RISK

open ↗

Referência

CVE-2017-17637

CVE-2017-17637—

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.

23RISK

open ↗

Referência

CVE-2017-17637

CVE-2017-17637—

Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.

23RISK

open ↗

Referência

CVE-2022-4297

CVE-2022-4297CRITICAL

WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2022-4297

CVE-2022-4297CRITICAL

WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2022-44149

CVE-2022-44149HIGH

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by

53RISK

open ↗

Referência

CVE-2022-44149

CVE-2022-44149HIGH

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by

53RISK

open ↗

Referência

CVE-2022-44877

CVE-2022-44877CRITICALunder attack

100RISK

open ↗

Referência

CVE-2017-2373

CVE-2017-2373—

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS

23RISK

open ↗

Referência

CVE-2017-2478

CVE-2017-2478—

An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS b

23RISK

open ↗

Referência

CVE-2017-3106

CVE-2017-3106—

Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF fil

28RISK

open ↗

Referência

CVE-2022-45030

CVE-2022-45030HIGH

A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may

41RISK

open ↗

Referência

CVE-2022-45297

CVE-2022-45297CRITICAL

EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.

48RISK

open ↗

Referência

CVE-2022-45701

CVE-2022-45701HIGH

Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.

53RISK

open ↗

Referência

CVE-2017-6998

CVE-2017-6998—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO

23RISK

open ↗

Referência

CVE-2017-7237

CVE-2017-7237—

The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spicewor

23RISK

open ↗

Referência

CVE-2023-0915

CVE-2023-0915MEDIUM

SourceCodester Auto Dealer Management System sql injection

33RISK

open ↗

Referência

CVE-2023-0938

CVE-2023-0938MEDIUM

SourceCodester Music Gallery Site GET Request music_list.php sql injection

33RISK

open ↗

Referência

CVE-2023-0961

CVE-2023-0961MEDIUM

SourceCodester Music Gallery Site GET Request view_music_details.php sql injection

33RISK

open ↗

Referência

CVE-2023-0962

CVE-2023-0962MEDIUM

SourceCodester Music Gallery Site GET Request Master.php sql injection

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.