Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
22,407 exploits
Referência
CVE-2009-3972
CVE-2009-3972—
SQL injection vulnerability in the Q-Proje Siirler Bileseni (com_siirler) component 1.2 RC for Joomla! allows remote att
23RISK
open ↗
Referência
CVE-2018-12054
CVE-2018-12054—
Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absol
50RISK
open ↗
Referência
CVE-2017-17968
CVE-2017-17968—
A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remot
50RISK
open ↗
Referência
CVE-2022-28171
CVE-2022-28171HIGH
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to t
53RISK
open ↗
Referência
CVE-2022-28171
CVE-2022-28171HIGH
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to t
53RISK
open ↗
Referência
CVE-2018-8716
CVE-2018-8716—
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
35RISK
open ↗
Referência
CVE-2018-8716
CVE-2018-8716—
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
35RISK
open ↗
Referência✓ VexDay Proof
Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion
CVE-2009-1847—webappsphp
Directory traversal vulnerability in index.php in Easy PX 41 CMS 9.0 B1 allows remote attackers to include and execute a
23RISK
open ↗
Referência
CVE-2011-3478
CVE-2011-3478—
The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.
35RISK
open ↗
Referência
CVE-2013-4800
CVE-2013-4800—
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown ve
50RISK
open ↗
Referência
CVE-2018-16133
CVE-2018-16133—
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
50RISK
open ↗
Referência
CVE-2017-12943
CVE-2017-12943—
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?RE
35RISK
open ↗
Referência
CVE-2018-5262
CVE-2018-5262—
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute
35RISK
open ↗
Referência✓ VexDay Proof
Foxit Reader 9.7.1 - Remote Command Execution (Javascript API)
CVE-2020-14425—localwindows
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can exe
35RISK
open ↗
Referência✓ VexDay Proof
phpBB All Topics Mod 1.5.0 - 'start' SQL Injection
CVE-2006-4367—webappsphp
SQL injection vulnerability in alltopics.php in the All Topics Hack 1.5.0 and earlier for phpBB 2.0.21 allows remote att
23RISK
open ↗
Referência
CVE-2016-20016
CVE-2016-20016CRITICAL
MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /
85RISK
open ↗
Referência
CVE-2019-1003001
CVE-2019-1003001—
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
60RISK
open ↗
Referência
CVE-2018-15379
CVE-2018-15379—
Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability
60RISK
open ↗
Referência✓ VexDay Proof
Mambo Component com_lurm_constructor 0.6b - Remote File Inclusion
CVE-2006-4372—webappsphp
PHP remote file inclusion vulnerability in admin.lurm_constructor.php in the Lurm Constructor component (com_lurm_constr
23RISK
open ↗
Referência
CVE-2013-7091
CVE-2013-7091—
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zim
60RISK
open ↗
Referência✓ VexDay Proof
pSlash 0.7 - 'lvc_include_dir' Remote File Inclusion
CVE-2006-4373—webappsphp
PHP remote file inclusion vulnerability in modules/visitors2/include/config.inc.php in pSlash 0.70 allows remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
PeopleAggregator 1.2pre6-release-53 - Multiple Remote File Inclusions
CVE-2007-5631—webappsphp
Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow
35RISK
open ↗
Referência
CVE-2021-28476
CVE-2021-28476CRITICAL
Windows Hyper-V Remote Code Execution Vulnerability
60RISK
open ↗
Referência
CVE-2013-0090
CVE-2013-0090HIGH
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary co
53RISK
open ↗
Referência✓ VexDay Proof
Apple QuickTime 7.2/7.3 (OSX/Windows) - RSTP Response Universal
CVE-2002-0252—remotemultiple
Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a respon
28RISK
open ↗
Referência
CVE-2018-8474
CVE-2018-8474—
A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messa
35RISK
open ↗
Referência
CVE-2018-7658
CVE-2018-7658—
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service
35RISK
open ↗
Referência
CVE-2018-7658
CVE-2018-7658—
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service
35RISK
open ↗
Referência
CVE-2015-2843
CVE-2015-2843—
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute
50RISK
open ↗
Referência
CVE-2020-5735
CVE-2020-5735HIGHunder attack
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacke
83RISK
open ↗
← previouspage 533 / 747next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.