Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits

32,133CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecent popular risk

19,967 exploits

Referência

CVE-2012-3753

CVE-2012-3753—

Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause

50RISK

open ↗

Referência

Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)

CVE-2009-1185—

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga

60RISK

open ↗

Referência

CVE-2009-3429

CVE-2009-3429—

Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code

50RISK

open ↗

Referência

CVE-2020-35775

CVE-2020-35775—

CITSmart before 9.1.2.23 allows LDAP Injection.

28RISK

open ↗

Referência

CVE-2020-35391

CVE-2020-35391CRITICAL

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_pas

60RISK

open ↗

Referência

CVE-2015-6168

CVE-2015-6168—

Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a

35RISK

open ↗

Referência

CVE-2021-43164

CVE-2021-43164—

A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.191

35RISK

open ↗

Referência

CVE-2010-2103

CVE-2010-2103—

Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Ap

35RISK

open ↗

Referência

CVE-2013-0019

CVE-2013-0019—

Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary co

35RISK

open ↗

Referência

CVE-2016-0971

CVE-2016-0971—

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS

35RISK

open ↗

Referência

CVE-2013-5065

CVE-2013-5065HIGHunder attack

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges

98RISK

open ↗

Referência

CVE-2021-37975

CVE-2021-37975HIGHunder attack

Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corrup

83RISK

open ↗

Referência

CVE-2017-11282

CVE-2017-11282—

Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation co

35RISK

open ↗

Referência

Fuzzylime CMS 3.01 - 'admindir' Remote File Inclusion

CVE-2008-1405—

PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute a

35RISK

open ↗

Referência

CVE-2019-10266

CVE-2019-10266—

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL

28RISK

open ↗

Referência

phpAuction GPL Enhanced 2.51 - Multiple Remote File Inclusions

CVE-2008-1416—

Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PH

35RISK

open ↗

Referência

CVE-2019-19844

CVE-2019-19844—

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address

35RISK

open ↗

Referência

CVE-2016-9150

CVE-2016-9150—

Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b

35RISK

open ↗

Referência

CVE-2008-2683

CVE-2008-2683—

The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to for

50RISK

open ↗

Referência

Black Ice Software Inc Barcode SDK - 'BIDIB.ocx' Multiple Vulnerabilities

CVE-2008-2683—

The BIDIB.BIDIBCtrl.1 ActiveX control in BIDIB.ocx 10.9.3.0 in Black Ice Barcode SDK 5.01 allows remote attackers to for

50RISK

open ↗

Referência

CVE-2019-9880

CVE-2019-9880—

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible,

50RISK

open ↗

Referência

CVE-2013-0742

CVE-2013-0742—

Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial

35RISK

open ↗

Referência

CVE-2016-2233

CVE-2016-2233—

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve

35RISK

open ↗

Referência

CVE-2016-2233

CVE-2016-2233—

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve

35RISK

open ↗

Referência

CVE-2022-27226

CVE-2022-27226—

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in

35RISK

open ↗

Referência

CVE-2015-2463

CVE-2015-2463—

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2

35RISK

open ↗

Referência

CVE-2013-0928

CVE-2013-0928—

The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote

50RISK

open ↗

Referência

CVE-2015-2177

CVE-2015-2177HIGH

Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via craf

53RISK

open ↗

Referência

CVE-2008-6740

CVE-2008-6740—

PHP remote file inclusion vulnerability in html/admin/modules/plugin_admin.php in HoMaP-CMS 0.1 allows remote attackers

23RISK

open ↗

Referência

CVE-2020-8656

CVE-2020-8656—

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthe

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.