Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
22,367 exploits
Referência
CVE-2016-0185
CVE-2016-0185HIGHunder attack
Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary
83RISK
open ↗
Referência
CVE-2021-32682
CVE-2021-32682CRITICAL
Multiple vulnerabilities leading to RCE
75RISK
open ↗
Referência
CVE-2015-5082
CVE-2015-5082—
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW
50RISK
open ↗
Referência
CVE-2015-5082
CVE-2015-5082—
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW
50RISK
open ↗
Referência
CVE-2015-5082
CVE-2015-5082—
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW
50RISK
open ↗
Referência
CVE-2015-5082
CVE-2015-5082—
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW
50RISK
open ↗
Referência
CVE-2014-8517
CVE-2014-8517—
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 thro
50RISK
open ↗
Referência
CVE-2016-1106
CVE-2016-1106—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗
Referência
CVE-2016-1106
CVE-2016-1106—
Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof
35RISK
open ↗
Referência
CVE-2012-0201
CVE-2012-0201—
Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x befo
50RISK
open ↗
Referência✓ VexDay Proof
PHP Generic library & Framework - 'INCLUDE_PATH' Remote File Inclusion
CVE-2007-0584—webappsphp
PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neri
35RISK
open ↗
Referência✓ VexDay Proof
EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)
CVE-2007-3605—doswindows
Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP
50RISK
open ↗
Referência✓ VexDay Proof
Novell eDirectory < 8.7.3 SP 10 / 8.8.2 - HTTP headers Denial of Service
CVE-2008-0927—doswindows
dhost.exe in Novell eDirectory 8.7.3 before sp10 and 8.8.2 allows remote attackers to cause a denial of service (CPU con
45RISK
open ↗
Referência
CVE-2009-2926
CVE-2009-2926—
Multiple SQL injection vulnerabilities in PHP Competition System BETA 0.84 and earlier allow remote attackers to execute
23RISK
open ↗
Referência
CVE-2018-8466
CVE-2018-8466—
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISK
open ↗
Referência
CVE-2018-11646
CVE-2018-11646—
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RISK
open ↗
Referência
CVE-2018-10594
CVE-2018-10594—
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS
50RISK
open ↗
Referência
CVE-2018-10594
CVE-2018-10594—
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS
50RISK
open ↗
Referência✓ VexDay Proof
OpenSSL < 0.9.8i - DTLS ChangeCipherSpec Remote Denial of Service
CVE-2009-1386—dosmultiple
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and
60RISK
open ↗
Referência✓ VexDay Proof
CRE Loaded 6.2 - 'products_id' SQL Injection
CVE-2009-1403—webappsphp
SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗
Referência
CVE-2021-34621
CVE-2021-34621CRITICAL
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
75RISK
open ↗
Referência
CVE-2022-22960
CVE-2022-22960HIGHunder attack
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
98RISK
open ↗
Referência
CVE-2016-0099
CVE-2016-0099HIGHunder attackransomware
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8
98RISK
open ↗
Referência
CVE-2020-0601
CVE-2020-0601HIGHunder attack
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RISK
open ↗
Referência
CVE-2020-0601
CVE-2020-0601HIGHunder attack
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RISK
open ↗
Referência
CVE-2014-6039
CVE-2014-6039—
ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed versio
50RISK
open ↗
Referência
CVE-2017-8670
CVE-2017-8670—
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code
35RISK
open ↗
Referência
CVE-2012-5687
CVE-2012-5687—
Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13
50RISK
open ↗
Referência
CVE-2016-7286
CVE-2016-7286—
The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
35RISK
open ↗
Referência
CVE-2016-7286
CVE-2016-7286—
The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
35RISK
open ↗
← previouspage 523 / 746next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.