Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência
CVE-2009-3709
CVE-2009-3709—
Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-a
23RISK
open ↗
Referência
CVE-2014-1785
CVE-2014-1785—
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory co
35RISK
open ↗
Referência
CVE-2009-2361
CVE-2009-2361—
SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2018-16517
CVE-2018-16517—
asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a deni
23RISK
open ↗
Referência
CVE-2018-16517
CVE-2018-16517—
asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a deni
23RISK
open ↗
Referência
CVE-2018-8817
CVE-2018-8817—
Wampserver before 3.1.3 has CSRF in add_vhost.php.
23RISK
open ↗
Referência
CVE-2008-1247
CVE-2008-1247—
The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts,
23RISK
open ↗
Referência✓ VexDay Proof
VRNews 1.1.1 - 'admin.php' Remote Security Bypass
CVE-2007-3611—webappsphp
admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attacke
23RISK
open ↗
Referência
CVE-2011-1974
CVE-2011-1974—
NDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2 and SP3 and Windows Serve
23RISK
open ↗
Referência
CVE-2021-42165
CVE-2021-42165—
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing c
28RISK
open ↗
Referência
CVE-2019-1144
CVE-2019-1144HIGH
Microsoft Graphics Remote Code Execution Vulnerability
46RISK
open ↗
Referência
CVE-2021-20031
CVE-2021-20031—
A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management
43RISK
open ↗
Referência
CVE-2018-6911
CVE-2018-6911—
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS
28RISK
open ↗
Referência✓ VexDay Proof
phpEmployment - 'PHP Upload' Arbitrary File Upload
CVE-2008-6920—webappsphp
Unrestricted file upload vulnerability in auth.php in phpEmployment 1.8 allows remote attackers to execute arbitrary cod
23RISK
open ↗
Referência✓ VexDay Proof
Agora 1.4 RC1 - 'MysqlfinderAdmin.php' Remote File Inclusion
CVE-2006-7194—webappsphp
PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when register_glob
23RISK
open ↗
Referência
CVE-2017-18256
CVE-2017-18256—
Brave Browser before 0.13.0 allows remote attackers to cause a denial of service (resource consumption) via a long alert
23RISK
open ↗
Referência
CVE-2012-0904
CVE-2012-0904—
VLC media player 1.1.11 allows remote attackers to cause a denial of service (crash) via a long string in an amr file.
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin Photoracer 1.0 - 'id' SQL Injection
CVE-2009-2122—webappsphp
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote atta
23RISK
open ↗
Referência
CVE-2017-8477
CVE-2017-8477—
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,
23RISK
open ↗
Referência
CVE-2023-4114
CVE-2023-4114MEDIUM
PHP Jabbers Night Club Booking Software index.php cross site scripting
48RISK
open ↗
Referência
CVE-2014-1854
CVE-2014-1854—
SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free p
23RISK
open ↗
Referência
CVE-2017-13876
CVE-2017-13876—
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Referência
CVE-2022-50794
CVE-2022-50794CRITICAL
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username
48RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Explorer - '.AVI' File Denial of Service
CVE-2007-0562—doswindows
Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause
28RISK
open ↗
Referência✓ VexDay Proof
Maian Recipe 1.0 - 'path_to_folder' Remote File Inclusion
CVE-2007-0848—webappsphp
PHP remote file inclusion vulnerability in classes/class_mail.inc.php in Maian Recipe 1.0 allows remote attackers to exe
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Visual InterDev 6.0 SP6 - '.sln' Local Buffer Overflow (PoC)
CVE-2008-1709—doswindows
Buffer overflow in Microsoft Visual InterDev 6.0 (SP6) allows user-assisted attackers to execute arbitrary code via a St
28RISK
open ↗
Referência✓ VexDay Proof
Carscripts Classifieds - 'cat' SQL Injection
CVE-2008-2844—webappsphp
SQL injection vulnerability in index.php in Carscripts Classifieds allows remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência
Mitrastar GPT-2541GNAC-N1 - Privilege escalation
CVE-2021-42165—remotehardware
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing c
28RISK
open ↗
Referência
Webmin 1.996 - Remote Code Execution (RCE) (Authenticated)
CVE-2022-36446—webappslinux
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗
Referência✓ VexDay Proof
Vinagre < 2.24.2 - 'show_error()' Remote Format String (PoC)
CVE-2008-5660—doswindows
Format string vulnerability in the vinagre_utils_show_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2
23RISK
open ↗
← previouspage 578 / 751next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.