Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits

35,607CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecent popular risk

22,407 exploits

Referência

CVE-2022-24562

CVE-2022-24562—

In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary

35RISK

open ↗

Referência

CVE-2017-8480

CVE-2017-8480—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RISK

open ↗

Referência

CVE-2008-6264

CVE-2008-6264—

SQL injection vulnerability in admin/admin.php in E-topbiz Slide Popups 1.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2017-9430

CVE-2017-9430—

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) o

28RISK

open ↗

Referência

CVE-2017-9430

CVE-2017-9430—

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) o

28RISK

open ↗

Referência

CVE-2010-2020

CVE-2010-2020—

sys/nfsclient/nfs_vfsops.c in the NFS client in the kernel in FreeBSD 7.2 through 8.1-PRERELEASE, when vfs.usermount is

23RISK

open ↗

Referência

CVE-2007-2583

CVE-2007-2583—

The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-depen

28RISK

open ↗

Referência

CVE-2010-2028

CVE-2010-2028—

Buffer overflow in k23productions TFTPUtil GUI (aka TFTPGUI) 1.4.5 allows remote attackers to cause a denial of service

28RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin st_newsletter - SQL Injection

CVE-2008-0683—webappsphp

SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress al

23RISK

open ↗

Referência✓ VexDay Proof

Oracle Internet Directory 10.1.4 - Remote Denial of Service

CVE-2008-2595—dosmultiple

Unspecified vulnerability in the Oracle Internet Directory component in Oracle Application Server 9.0.4.3, 10.1.2.3, and

28RISK

open ↗

Referência

CVE-2014-4927

CVE-2014-4927—

Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 router

28RISK

open ↗

Referência

CVE-2014-4927

CVE-2014-4927—

Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 router

28RISK

open ↗

Referência

CVE-2018-6460

CVE-2018-6460—

Hotspot Shield runs a webserver with a static IP address 127.0.0.1 and port 895. The web server uses JSONP and hosts sen

28RISK

open ↗

Referência

CVE-2015-2196

CVE-2015-2196—

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQ

43RISK

open ↗

Referência

CVE-2017-2619

CVE-2017-2619—

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access

28RISK

open ↗

Referência

CVE-2018-11511

CVE-2018-11511—

The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability

43RISK

open ↗

Referência

CVE-2016-3861

CVE-2016-3861—

LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016

23RISK

open ↗

Referência

CVE-2017-8476

CVE-2017-8476—

The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

23RISK

open ↗

Referência

CVE-2014-1903

CVE-2014-1903—

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12

50RISK

open ↗

Referência✓ VexDay Proof

ITechBids 5.0 - 'item_id' SQL Injection

CVE-2008-0692—webappsphp

SQL injection vulnerability in bidhistory.php in iTechBids 3 Gold and 5.0 allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2024-21338

CVE-2024-21338HIGHunder attackransomware

Windows Kernel Elevation of Privilege Vulnerability

83RISK

open ↗

Referência

CVE-2019-8929

CVE-2019-8929—

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon

28RISK

open ↗

Referência

CVE-2019-8929

CVE-2019-8929—

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon

28RISK

open ↗

Referência

CVE-2010-1979

CVE-2010-1979—

Directory traversal vulnerability in the Affiliate Datafeeds (com_datafeeds) component build 880 for Joomla! allows remo

43RISK

open ↗

Referência

CVE-2017-1002001

CVE-2017-1002001—

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS so

28RISK

open ↗

Referência

CVE-2014-1903

CVE-2014-1903—

admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12

50RISK

open ↗

Referência

CVE-2016-8655

CVE-2016-8655—

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau

43RISK

open ↗

Referência

CVE-2016-8655

CVE-2016-8655—

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau

43RISK

open ↗

Referência

CVE-2016-8655

CVE-2016-8655—

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau

43RISK

open ↗

Referência

CVE-2009-2883

CVE-2009-2883—

SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote atta

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.