Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits

35,552CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecent popular risk

22,367 exploits

Referência

CVE-2018-18323

CVE-2018-18323—

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/

60RISK

open ↗

Referência

CVE-2013-6117

CVE-2013-6117—

Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive informatio

50RISK

open ↗

Referência

CVE-2019-9978

CVE-2019-9978MEDIUMunder attack

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

100RISK

open ↗

Referência

CVE-2014-8686

CVE-2014-8686—

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-

50RISK

open ↗

Referência

CVE-2017-8634

CVE-2017-8634—

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current u

45RISK

open ↗

Referência

CVE-2012-4869

CVE-2012-4869—

The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attacke

60RISK

open ↗

Referência

CVE-2012-4869

CVE-2012-4869—

The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attacke

60RISK

open ↗

Referência

CVE-2021-2109

CVE-2021-2109HIGH

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

63RISK

open ↗

Referência

CVE-2015-4495

CVE-2015-4495HIGHunder attack

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

98RISK

open ↗

Referência

CVE-2009-2847

CVE-2009-2847—

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when runnin

23RISK

open ↗

Referência

CVE-2021-45010

CVE-2021-45010—

A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7

45RISK

open ↗

Referência✓ VexDay Proof

ZeroShell 1.0beta11 - Remote Code Execution

CVE-2009-0545—remotehardware

cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell meta

60RISK

open ↗

Referência✓ VexDay Proof

moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting

CVE-2009-1369—webappsphp

moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) p

23RISK

open ↗

Referência

CVE-2017-11873

CVE-2017-11873—

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709

35RISK

open ↗

Referência

CVE-2014-0257

CVE-2014-0257—

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it

50RISK

open ↗

Referência

CVE-2014-0257

CVE-2014-0257—

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it

50RISK

open ↗

Referência

CVE-2011-3176

CVE-2011-3176—

Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allo

60RISK

open ↗

Referência

CVE-2025-48827

CVE-2025-48827CRITICAL

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'

85RISK

open ↗

Referência

CVE-2011-1567

CVE-2011-1567—

Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Grap

50RISK

open ↗

Referência✓ VexDay Proof

phpMyAdmin - '/scripts/setup.php' PHP Code Injection

CVE-2009-1151CRITICALunder attackwebappsphp

Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remo

100RISK

open ↗

Referência

CVE-2012-5900

CVE-2012-5900—

Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2012-5903

CVE-2012-5903—

Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrar

23RISK

open ↗

Referência

CVE-2012-5919

CVE-2012-5919—

Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit

23RISK

open ↗

Referência

Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)

CVE-2021-42071—webappsmultiple

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharac

50RISK

open ↗

Referência

CVE-2009-2926

CVE-2009-2926—

Multiple SQL injection vulnerabilities in PHP Competition System BETA 0.84 and earlier allow remote attackers to execute

23RISK

open ↗

Referência

CVE-2018-8466

CVE-2018-8466—

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

35RISK

open ↗

Referência

CVE-2018-11646

CVE-2018-11646—

webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon

50RISK

open ↗

Referência

CVE-2018-10594

CVE-2018-10594—

Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS

50RISK

open ↗

Referência

CVE-2018-10594

CVE-2018-10594—

Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS

50RISK

open ↗

Referência✓ VexDay Proof

OpenSSL < 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service

CVE-2009-1386—dosmultiple

ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.