Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,587cataloged exploits

35,644CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,428GitHub PoC 14,268VulnCheck XDB 8,663Nuclei 4,299Metasploit 3,474✓ verified onlyrecent popular risk

22,429 exploits

Referência

CVE-2013-7246

CVE-2013-7246—

Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows

28RISK

open ↗

Referência

CVE-2013-7246

CVE-2013-7246—

Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows

28RISK

open ↗

Referência

CVE-2010-2033

CVE-2010-2033—

Directory traversal vulnerability in the Percha Multicategory Article (com_perchacategoriestree) component 0.6 for Jooml

43RISK

open ↗

Referência

CVE-2017-8470

CVE-2017-8470—

Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,

23RISK

open ↗

Referência

CVE-2010-3904

CVE-2010-3904HIGHunder attack

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the

91RISK

open ↗

Referência

CVE-2017-5174

CVE-2017-5174—

An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authenticatio

35RISK

open ↗

Referência

CVE-2015-4117

CVE-2015-4117—

Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharac

28RISK

open ↗

Referência

CVE-2013-5660

CVE-2013-5660—

Buffer overflow in Power Software WinArchiver 3.2 allows remote attackers to execute arbitrary code via a crafted .zip f

28RISK

open ↗

Referência

CVE-2016-8380

CVE-2016-8380—

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.

28RISK

open ↗

Referência

CVE-2016-8371

CVE-2016-8371—

The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism i

28RISK

open ↗

Referência✓ VexDay Proof

Site@School 2.4.02 - Arbitrary File Upload

CVE-2006-4920—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Site@School (S@S) 2.4.02 and earlier allow remote attackers to exe

28RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component NeoReferences 1.3.1 - 'catid' SQL Injection

CVE-2008-0686—webappsphp

SQL injection vulnerability in index.php in the NeoReferences (com_neoreferences) 1.3.1 and 1.3.3 component for Joomla!

23RISK

open ↗

Referência

CVE-2009-2254

CVE-2009-2254—

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows

28RISK

open ↗

Referência

CVE-2009-4816

CVE-2009-4816—

Directory traversal vulnerability in api/download_checker.php in MegaLab The Uploader 2.0 allows remote attackers to rea

23RISK

open ↗

Referência

CVE-2018-10123

CVE-2018-10123—

p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via reques

28RISK

open ↗

Referência

CVE-2015-5452

CVE-2015-5452—

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2014-8656

CVE-2014-8656—

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d

28RISK

open ↗

Referência

CVE-2014-8656

CVE-2014-8656—

The Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640-3.5.11.7-NOSH have a d

28RISK

open ↗

Referência

CVE-2010-2330

CVE-2010-2330—

Stack-based buffer overflow in iSharer File Sharing Wizard 1.5.0 allows remote attackers to cause a denial of service (c

28RISK

open ↗

Referência

CVE-2010-4259

CVE-2010-4259—

Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application cras

28RISK

open ↗

Referência

CVE-2018-9302

CVE-2018-9302—

SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to r

23RISK

open ↗

Referência

CVE-2014-1907

CVE-2014-1907—

Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for Wor

28RISK

open ↗

Referência

CVE-2015-6567

CVE-2015-6567—

Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/

28RISK

open ↗

Referência

CVE-2017-3006

CVE-2017-3006—

Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions durin

28RISK

open ↗

Referência

CVE-2013-6234

CVE-2013-6234—

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users

23RISK

open ↗

Referência

CVE-2010-5301

CVE-2010-5301—

Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD re

28RISK

open ↗

Referência

CVE-2013-6618

CVE-2013-6618—

jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,

28RISK

open ↗

Referência✓ VexDay Proof

Joomla! / Mambo Component SWmenu 4.0 - Remote File Inclusion

CVE-2007-1699—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Ma

28RISK

open ↗

Referência

CVE-2012-6499

CVE-2012-6499—

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

43RISK

open ↗

Referência

CVE-2018-1756

CVE-2018-1756HIGH

IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker co

46RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.