Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,545cataloged exploits

35,609CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,299Metasploit 3,474✓ verified onlyrecent popular risk

22,415 exploits

Referência

CVE-2009-4749

CVE-2009-4749—

Multiple SQL injection vulnerabilities in PHP Live! 3.2.1 and 3.2.2 allow remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2014-8673

CVE-2014-8673—

Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in

28RISK

open ↗

Referência

CVE-2014-8673

CVE-2014-8673—

Multiple SQL vulnerabilities exist in planning.php, user_list.php, projets.php, user_groupes.php, and groupe_list.php in

28RISK

open ↗

Referência

CVE-2017-15118

CVE-2017-15118HIGH

A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client

46RISK

open ↗

Referência

CVE-2010-3595

CVE-2010-3595—

Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 all

28RISK

open ↗

Referência

CVE-2015-7039

CVE-2015-7039—

Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows rem

28RISK

open ↗

Referência

CVE-2021-33990

CVE-2021-33990CRITICAL

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The

53RISK

open ↗

Referência

CVE-2011-1525

CVE-2011-1525—

Heap-based buffer overflow in rvrender.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and R

28RISK

open ↗

Referência

CVE-2010-1597

CVE-2010-1597—

Stack-based buffer overflow in zgtips.dll in ZipGenius 6.3.1.2552 allows user-assisted remote attackers to execute arbit

28RISK

open ↗

Referência

CVE-2020-28687

CVE-2020-28687—

The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upl

28RISK

open ↗

Referência

CVE-2013-5758

CVE-2013-5758—

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by

28RISK

open ↗

Referência

CVE-2013-5758

CVE-2013-5758—

cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by

28RISK

open ↗

Referência

CVE-2010-1925

CVE-2010-1925—

SQL injection vulnerability in makale.php in tekno.Portal 0.1b allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

Microsoft Word 2007 - Multiple Vulnerabilities

CVE-2007-1911—doswindows

Multiple unspecified vulnerabilities in Microsoft Word 2007 allow remote attackers to cause a denial of service (CPU con

28RISK

open ↗

Referência✓ VexDay Proof

EDraw Office Viewer Component - Denial of Service

CVE-2007-3169—doswindows

Buffer overflow in a certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and

28RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Ynews 1.0.0 - 'id' SQL Injection

CVE-2008-0653—webappsphp

SQL injection vulnerability in index.php in the Ynews (com_ynews) 1.0.0 component for Joomla! allows remote attackers to

23RISK

open ↗

Referência

CVE-2014-3976

CVE-2014-3976—

Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allow

28RISK

open ↗

Referência

CVE-2014-3976

CVE-2014-3976—

Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allow

28RISK

open ↗

Referência

CVE-2023-26068

CVE-2023-26068CRITICAL

Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).

68RISK

open ↗

Referência

CVE-2020-1380

CVE-2020-1380HIGHunder attack

Scripting Engine Memory Corruption Vulnerability

76RISK

open ↗

Referência

CVE-2019-9189

CVE-2019-9189—

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when

28RISK

open ↗

Referência

CVE-2018-8947

CVE-2018-8947—

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easi

28RISK

open ↗

Referência

CVE-2019-19731

CVE-2019-19731—

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary loc

28RISK

open ↗

Referência

CVE-2013-3502

CVE-2013-3502—

monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to ex

50RISK

open ↗

Referência

CVE-2019-1253

CVE-2019-1253HIGHunder attackransomware

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To e

76RISK

open ↗

Referência

CVE-2010-1957

CVE-2010-1957—

Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attack

43RISK

open ↗

Referência

CVE-2019-12276

CVE-2019-12276—

A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows

50RISK

open ↗

Referência✓ VexDay Proof

MailBee WebMail Pro 4.1 - Remote File Disclosure

CVE-2008-0333—webappsasp

Directory traversal vulnerability in download_view_attachment.aspx in AfterLogic MailBee WebMail Pro 4.1 for ASP.NET all

28RISK

open ↗

Referência✓ VexDay Proof

Apple QuickTime 7.5.5 / iTunes 8.0 - Remote Off-by-One Crash

CVE-2008-4116—dosmultiple

Buffer overflow in Apple QuickTime 7.5.5 and iTunes 8.0 allows remote attackers to cause a denial of service (browser cr

28RISK

open ↗

Referência

CVE-2009-2790

CVE-2009-2790—

SQL injection vulnerability in cat_products.php in SoftBiz Dating Script allows remote attackers to execute arbitrary SQ

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.