Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
22,367 exploits
Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (1)
CVE-2009-0174—localwindows
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RISK
open ↗
Referência
CVE-2020-11023
CVE-2020-11023MEDIUMunder attack
Potential XSS vulnerability in jQuery
85RISK
open ↗
Referência✓ VexDay Proof
VUPlayer 2.49 - '.asx' HREF Local Buffer Overflow (2)
CVE-2009-0174—localwindows
Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in th
28RISK
open ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗
Referência
CVE-2019-1620
CVE-2019-1620CRITICAL
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗
Referência✓ VexDay Proof
Free Download Manager 2.5/3.0 - Authorisation Stack Buffer Overflow (PoC)
CVE-2009-0183—doswindows
Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allo
50RISK
open ↗
Referência
CVE-2015-3035
CVE-2015-3035HIGHunder attack
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before
100RISK
open ↗
Referência
CVE-2023-25690
CVE-2023-25690CRITICAL
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RISK
open ↗
Referência
CVE-2023-2796
CVE-2023-2796—
EventON < 2.1.2 - Unauthenticated Event Access
50RISK
open ↗
Referência✓ VexDay Proof
Rankem - File Disclosure / Cross-Site Scripting / Cookie
CVE-2009-0249—webappsphp
Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remot
23RISK
open ↗
Referência
CVE-2017-14493
CVE-2017-14493—
Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu
45RISK
open ↗
Referência
CVE-2019-3010
CVE-2019-3010HIGHunder attack
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is a
91RISK
open ↗
Referência
CVE-2016-10073
CVE-2016-10073—
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the emai
60RISK
open ↗
Referência
CVE-2016-10073
CVE-2016-10073—
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the emai
60RISK
open ↗
Referência
CVE-2021-25094
CVE-2021-25094—
Tatsu < 3.3.12 - Unauthenticated RCE
60RISK
open ↗
Referência✓ VexDay Proof
phosheezy 2.0 - Remote Command Execution
CVE-2009-0251—webappsphp
Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to
23RISK
open ↗
Referência✓ VexDay Proof
Flax Article Manager 1.1 - 'cat_id' SQL Injection
CVE-2009-0284—webappsphp
SQL injection vulnerability in category.php in Flax Article Manager 1.1 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2010-2075
CVE-2010-2075—
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally
60RISK
open ↗
Referência✓ VexDay Proof
OpenGoo 1.1 - Local File Inclusion
CVE-2009-0286—webappsphp
Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register_globals is enabled and magic_quotes
23RISK
open ↗
Referência
CVE-2013-5311
CVE-2013-5311—
Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
blogit! - SQL Injection / File Disclosure / Cross-Site Scripting
CVE-2009-0336—webappsphp
Katy Whitton BlogIt! stores sensitive information under the web root with insufficient access control, which allows remo
23RISK
open ↗
Referência
CVE-2018-17254
CVE-2018-17254—
The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.
60RISK
open ↗
Referência✓ VexDay Proof
blogit! - SQL Injection / File Disclosure / Cross-Site Scripting
CVE-2009-0337—webappsphp
SQL injection vulnerability in index.asp in Katy Whitton BlogIt! allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2019-7194
CVE-2019-7194CRITICALunder attackransomware
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi
100RISK
open ↗
Referência
CVE-2019-14470
CVE-2019-14470—
cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has X
60RISK
open ↗
Referência
CVE-2020-7980
CVE-2020-7980—
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to th
60RISK
open ↗
Referência
CVE-2018-16763
CVE-2018-16763—
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗
Referência
CVE-2019-0539
CVE-2019-0539—
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗
Referência✓ VexDay Proof
Simple PHP NewsLetter 1.5 - Local File Inclusion
CVE-2009-0340—webappsphp
Multiple directory traversal vulnerabilities in Simple PHP Newsletter 1.5 allow remote attackers to read arbitrary files
23RISK
open ↗
Referência
CVE-2018-10660
CVE-2018-10660—
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
60RISK
open ↗
← previouspage 506 / 746next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.