Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits

35,607CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecent popular risk

22,407 exploits

Referência✓ VexDay Proof

Soulseek 157 NS - Remote Buffer Overflow (SEH)

CVE-2009-1830—remotewindows

Stack-based buffer overflow in Soulseek 156 and 157 NS allows remote attackers to execute arbitrary code via a long sear

23RISK

open ↗

Referência✓ VexDay Proof

Winamp 5.55 - MAKI script Universal Integer Overflow

CVE-2009-1831—localwindows

The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute

50RISK

open ↗

Referência✓ VexDay Proof

VideoLAN VLC Media Player < 0.9.6 - '.rt' Local Stack Buffer Overflow

CVE-2008-5036—localwindows

Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execu

50RISK

open ↗

Referência

CVE-2009-3858

CVE-2009-3858—

Cross-site scripting (XSS) vulnerability in GejoSoft allows remote attackers to inject arbitrary web script or HTML via

23RISK

open ↗

Referência

CVE-2018-14493

CVE-2018-14493—

Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inj

35RISK

open ↗

Referência

CVE-2015-3118

CVE-2015-3118—

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows

35RISK

open ↗

Referência

CVE-2018-10088

CVE-2018-10088—

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE

50RISK

open ↗

Referência

CVE-2014-0980

CVE-2014-0980—

Buffer overflow in Poster Software PUBLISH-iT 3.6d allows remote attackers to execute arbitrary code via a crafted PUI f

50RISK

open ↗

Referência

CVE-2015-6000

CVE-2015-6000—

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger

50RISK

open ↗

Referência

CVE-2017-14537

CVE-2017-14537—

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter

50RISK

open ↗

Referência

CVE-2017-5487

CVE-2017-5487—

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before

45RISK

open ↗

Referência

CVE-2014-8586

CVE-2014-8586—

SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to exe

50RISK

open ↗

Referência

CVE-2014-8586

CVE-2014-8586—

SQL injection vulnerability in the CP Multi View Event Calendar plugin 1.01 for WordPress allows remote attackers to exe

50RISK

open ↗

Referência

CVE-2016-1096

CVE-2016-1096—

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof

35RISK

open ↗

Referência

CVE-2016-1096

CVE-2016-1096—

Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsof

35RISK

open ↗

Referência

CVE-2016-6816

CVE-2016-6816—

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.

35RISK

open ↗

Referência

CVE-2023-2068

CVE-2023-2068—

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

50RISK

open ↗

Referência

CVE-2023-2068

CVE-2023-2068—

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

50RISK

open ↗

Referência

CVE-2016-3087

CVE-2016-3087—

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a

60RISK

open ↗

Referência

CVE-2009-3857

CVE-2009-3857—

Buffer overflow in Softonic International SciTE 1.72 allows user-assisted remote attackers to cause a denial of service

23RISK

open ↗

Referência

CVE-2019-17240

CVE-2019-17240LOW

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many

40RISK

open ↗

Referência

CVE-2019-17240

CVE-2019-17240LOW

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many

40RISK

open ↗

Referência

CVE-2009-3863

CVE-2009-3863—

Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause

23RISK

open ↗

Referência

CVE-2013-3660

CVE-2013-3660HIGHunder attack

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo

98RISK

open ↗

Referência

CVE-2023-4521

CVE-2023-4521CRITICAL

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

75RISK

open ↗

Referência

CVE-2018-7286

CVE-2018-7286—

An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asteris

35RISK

open ↗

Referência

CVE-2018-2791

CVE-2018-2791—

Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported

50RISK

open ↗

Referência

CVE-2009-3970

CVE-2009-3970—

SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote auth

23RISK

open ↗

Referência✓ VexDay Proof

Discloser 0.0.4 - 'fileloc' Remote File Inclusion

CVE-2006-4207—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Bob Jewell Discloser 0.0.4 and earlier allow remote attackers to e

23RISK

open ↗

Referência

CVE-2009-3975

CVE-2009-3975—

SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and 1.2.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.