Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits

35,840CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

22,573 exploits

Referência

CVE-2011-5109

CVE-2011-5109—

Multiple SQL injection vulnerabilities in Freelancer calendar 1.01 and earlier allow remote attackers to inject arbitrar

23RISK

open ↗

Referência

CVE-2010-3479

CVE-2010-3479—

SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2010-3479

CVE-2010-3479—

SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2009-4986

CVE-2009-4986—

Directory traversal vulnerability in index.php in In-Portal 4.3.1, when magic_quotes_gpc is disabled, allows remote atta

23RISK

open ↗

Referência

CVE-2010-1338

CVE-2010-1338—

SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows

23RISK

open ↗

Referência

CVE-2010-1338

CVE-2010-1338—

SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows

23RISK

open ↗

Referência

CVE-2010-4780

CVE-2010-4780—

SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and

23RISK

open ↗

Referência

CVE-2010-4780

CVE-2010-4780—

SQL injection vulnerability in the check_banlist function in includes/sessions.php in Enano CMS 1.1.7pl1; 1.0.6pl2; and

23RISK

open ↗

Referência

CVE-2011-0510

CVE-2011-0510—

SQL injection vulnerability in cart.php in Advanced Webhost Billing System (AWBS) 2.9.2 and possibly earlier allows remo

23RISK

open ↗

Referência✓ VexDay Proof

IntelliTamper 2.0.7 - HTML Parser Remote Buffer Overflow (PoC)

CVE-2008-3360—doswindows

Stack-based buffer overflow in the HTML parser in IntelliTamper 2.0.7 allows remote attackers to execute arbitrary code

23RISK

open ↗

Referência

CVE-2015-5889

CVE-2015-5889—

rsh in the remote_cmds component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors inv

38RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component com_Eventing 1.6.x - Blind SQL Injection

CVE-2009-0421—webappsphp

SQL injection vulnerability in the Eventing (com_eventing) 1.6.x component for Joomla! allows remote attackers to execut

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS 2.0.18 - Local File Inclusion / URL Redirecting

CVE-2008-0613—webappsphp

Open redirect vulnerability in htdocs/user.php in XOOPS 2.0.18 allows remote attackers to redirect users to arbitrary we

23RISK

open ↗

Referência✓ VexDay Proof

WebFileExplorer 3.1 - Authentication Bypass

CVE-2009-1323—webappsphp

SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

2DayBiz Business Community Script - Multiple Vulnerabilities

CVE-2009-1651—webappsphp

SQL injection vulnerability in admin/member_details.php in 2daybiz Business Community Script allows remote attackers to

23RISK

open ↗

Referência

CVE-2017-15971

CVE-2017-15971—

Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php send

23RISK

open ↗

Referência

CVE-2022-4953

CVE-2022-4953—

Elementor < 3.5.5 - Iframe Injection

23RISK

open ↗

Referência✓ VexDay Proof

PHP121 Instant Messenger 1.4 - Remote Code Execution

CVE-2006-1828—webappsphp

SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL command

23RISK

open ↗

Referência

CVE-2017-2528

CVE-2017-2528—

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The

23RISK

open ↗

Referência✓ VexDay Proof

OLIB 7 WebView 2.5.1.1 - 'infile' Local File Inclusion

CVE-2008-5678—webappsphp

Fretwell-Downing Informatics (FDI) OLIB7 WebView 2.5.1.1 allows remote authenticated users to obtain sensitive informati

23RISK

open ↗

Referência

CVE-2019-19493

CVE-2019-19493—

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea

23RISK

open ↗

Referência✓ VexDay Proof

Ktools Photostore 3.5.2 - Multiple SQL Injections

CVE-2008-6649—webappsphp

SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versio

23RISK

open ↗

Referência✓ VexDay Proof

Star Articles 6.0 - Blind SQL Injection (1)

CVE-2008-7075—webappsphp

Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star Articles 6.0 allow remote attackers to inject arbi

23RISK

open ↗

Referência

CVE-2010-1077

CVE-2010-1077—

Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers

23RISK

open ↗

Referência

CVE-2010-1077

CVE-2010-1077—

Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers

23RISK

open ↗

Referência

CVE-2015-3443

CVE-2015-3443—

Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before

23RISK

open ↗

Referência✓ VexDay Proof

webEdition 6.0.0.4 - 'WE_LANGUAGE' Local File Inclusion

CVE-2009-1222—webappsphp

Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and m

23RISK

open ↗

Referência✓ VexDay Proof

unclassified NewsBoard 1.6.4 - Multiple Vulnerabilities

CVE-2009-1948—webappsphp

Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals i

23RISK

open ↗

Referência

CVE-2010-2042

CVE-2010-2042—

SQL injection vulnerability in search.php in ECShop 2.7.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

phpCommunityCalendar 4.0.3 - Cross-Site Scripting / SQL Injection

CVE-2006-2797—webappsphp

Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL com

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.