Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
22,407 exploits
Referência
CVE-2010-1431
CVE-2010-1431—
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbit
23RISK
open ↗
Referência
CVE-2017-9080
CVE-2017-9080—
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile
50RISK
open ↗
Referência
CVE-2015-2068
CVE-2015-2068—
Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a
43RISK
open ↗
Referência
CVE-2010-1466
CVE-2010-1466—
Directory traversal vulnerability in scr/soustab.php in openUrgence Vaccin 1.03 allows remote attackers to read arbitrar
23RISK
open ↗
Referência
CVE-2018-1218
CVE-2018-1218—
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the '
28RISK
open ↗
Referência
CVE-2015-3088
CVE-2015-3088—
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows an
35RISK
open ↗
Referência
CVE-2016-3473
CVE-2016-3473—
Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0,
28RISK
open ↗
Referência
CVE-2013-3526
CVE-2013-3526—
Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earli
43RISK
open ↗
Referência
CVE-2020-5726
CVE-2020-5726—
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem
23RISK
open ↗
Referência
CVE-2017-10246
CVE-2017-10246—
Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Suppo
28RISK
open ↗
Referência
CVE-2021-31933
CVE-2021-31933HIGH
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a paramete
46RISK
open ↗
Referência
CVE-2018-4237
CVE-2018-4237—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
43RISK
open ↗
Referência
CVE-2013-6127
CVE-2013-6127—
The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53
28RISK
open ↗
Referência
CVE-2017-11152
CVE-2017-11152—
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
28RISK
open ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RISK
open ↗
Referência
CVE-2016-1879
CVE-2016-1879—
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
28RISK
open ↗
Referência
CVE-2019-1149
CVE-2019-1149HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RISK
open ↗
Referência
CVE-2019-3810
CVE-2019-3810MEDIUM
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported vers
38RISK
open ↗
Referência✓ VexDay Proof
Seagull 0.6.3 - 'files' Remote File Disclosure
CVE-2008-0465—webappsphp
Directory traversal vulnerability in optimizer.php in Seagull 0.6.3 allows remote attackers to read arbitrary files via
23RISK
open ↗
Referência✓ VexDay Proof
Comodo AntiVirus 2.0 - 'ExecuteStr()' Remote Command Execution
CVE-2008-0470—remotewindows
A certain ActiveX control in Comodo AntiVirus 2.0 allows remote attackers to execute arbitrary commands via the ExecuteS
35RISK
open ↗
Referência
CVE-2018-0709
CVE-2018-0709—
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow auth
28RISK
open ↗
Referência
CVE-2018-0709
CVE-2018-0709—
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow auth
28RISK
open ↗
Referência
CVE-2019-7391
CVE-2019-7391—
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
28RISK
open ↗
Referência
CVE-2019-7391
CVE-2019-7391—
ZyXEL VMG3312-B10B DSL-491HNU-B1B v2 devices allow login/login-page.cgi CSRF.
28RISK
open ↗
Referência
CVE-2010-1352
CVE-2010-1352—
Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2010-1491
CVE-2010-1491—
Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to r
43RISK
open ↗
Referência
CVE-2010-1491
CVE-2010-1491—
Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to r
43RISK
open ↗
Referência
CVE-2018-6383
CVE-2018-6383—
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but
28RISK
open ↗
Referência
CVE-2015-6589
CVE-2015-6589—
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before
28RISK
open ↗
Referência
CVE-2015-6589
CVE-2015-6589—
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before
28RISK
open ↗
← previouspage 542 / 747next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.