Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
22,367 exploits
Referência
CVE-2022-2143
CVE-2022-2143CRITICAL
Advantech iView
75RISK
open ↗
Referência
CVE-2016-9796
CVE-2016-9796—
Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP pro
28RISK
open ↗
Referência✓ VexDay Proof
MKPortal NoBoard Module (Beta) - Remote File Inclusion
CVE-2007-3813—webappsphp
PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attack
35RISK
open ↗
Referência✓ VexDay Proof
Avahi < 0.6.24 - mDNS Daemon Remote Denial of Service
CVE-2008-5081—dosmultiple
The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 al
50RISK
open ↗
Referência
CVE-2023-24078
CVE-2023-24078HIGH
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the c
53RISK
open ↗
Referência
CVE-2008-3922
CVE-2008-3922—
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences
50RISK
open ↗
Referência
CVE-2019-9760
CVE-2019-9760—
FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-cont
50RISK
open ↗
Referência
CVE-2016-7434
CVE-2016-7434—
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
35RISK
open ↗
Referência
CVE-2021-41381
CVE-2021-41381—
Payara Micro Community 5.2021.6 and below allows Directory Traversal.
50RISK
open ↗
Referência
CVE-2021-41381
CVE-2021-41381—
Payara Micro Community 5.2021.6 and below allows Directory Traversal.
50RISK
open ↗
Referência✓ VexDay Proof
Mini-stream Ripper 3.0.1.1 - '.asx' 'HREF' Local Buffer Overflow
CVE-2009-1641—localwindows
Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via
50RISK
open ↗
Referência
CVE-2019-11447
CVE-2019-11447—
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce
35RISK
open ↗
Referência
CVE-2019-11447
CVE-2019-11447—
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce
35RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.0 Member_Space Module - SQL Injection
CVE-2007-4956—webappsphp
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗
Referência✓ VexDay Proof
KwsPHP 1.0 stats Module - SQL Injection
CVE-2007-4956—webappsphp
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) th
23RISK
open ↗
Referência
CVE-2022-31470
CVE-2022-31470—
An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12
50RISK
open ↗
Referência
CVE-2009-3446
CVE-2009-3446—
SQL injection vulnerability in the MyRemote Video Gallery (com_mytube) component 1.0 Beta for Joomla! allows remote atta
23RISK
open ↗
Referência
CVE-2010-1622
CVE-2010-1622—
SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote at
35RISK
open ↗
Referência
CVE-2019-13068
CVE-2019-13068—
public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the
35RISK
open ↗
Referência
CVE-2011-4075
CVE-2011-4075—
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary
50RISK
open ↗
Referência
CVE-2025-40552
CVE-2025-40552CRITICAL
SolarWinds Web Help Desk Authentication Bypass Vulnerability
75RISK
open ↗
Referência
CVE-2011-0522
CVE-2011-0522—
The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/code
35RISK
open ↗
Referência
CVE-2014-9308
CVE-2014-9308—
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RISK
open ↗
Referência
CVE-2014-9308
CVE-2014-9308—
Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka Wor
50RISK
open ↗
Referência
CVE-2013-1408
CVE-2013-1408—
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenti
23RISK
open ↗
Referência
CVE-2017-8731
CVE-2017-8731—
Microsoft Edge in Microsoft Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the
35RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
Referência
CVE-2016-2388
CVE-2016-2388MEDIUMunder attack
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor
75RISK
open ↗
← previouspage 522 / 746next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.