Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits

39,953CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

25,846 exploits

Referência

CVE-2018-7300

CVE-2018-7300—

Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic C

35RISK

open ↗

Referência

CVE-2014-0050

CVE-2014-0050HIGH

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,

78RISK

open ↗

Referência

CVE-2017-12718

CVE-2017-12718—

A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version

28RISK

open ↗

Referência

CVE-2017-6026

CVE-2017-6026—

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware ver

35RISK

open ↗

Referência

CVE-2018-13415

CVE-2018-13415—

In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External En

35RISK

open ↗

Referência✓ VexDay Proof

Zip Store Chat 4.0/5.0 - Authentication Bypass

CVE-2009-2142—webappsphp

Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execut

23RISK

open ↗

Referência

CVE-2019-6714

CVE-2019-6714—

An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in Po

35RISK

open ↗

Referência

CVE-2017-15663

CVE-2017-15663—

In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The att

28RISK

open ↗

Referência

CVE-2018-9995

CVE-2018-9995—

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RISK

open ↗

Referência

CVE-2019-9041

CVE-2019-9041—

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filter

50RISK

open ↗

Referência

CVE-2014-1683

CVE-2014-1683—

The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248

50RISK

open ↗

Referência✓ VexDay Proof

Quick Tree View .NET 3.1 - Database Disclosure

CVE-2008-6387—webappsphp

Quick Tree View .NET 3.1 stores sensitive information under the web root with insufficient access control, which allows

23RISK

open ↗

Referência✓ VexDay Proof

campus virtual-lms - Cross-Site Scripting / SQL Injection

CVE-2009-2148—webappsphp

SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2009-4574

CVE-2009-4574—

SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

DM Guestbook 0.4.1 - Multiple Local File Inclusions

CVE-2007-5821—webappsphp

Multiple directory traversal vulnerabilities in DM Guestbook 0.4.1 and earlier allow remote attackers to include and exe

23RISK

open ↗

Referência

CVE-2009-4588

CVE-2009-4588—

Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlie

50RISK

open ↗

Referência✓ VexDay Proof

ASP AutoDealer - SQL Injection / File Disclosure

CVE-2008-5595—webappsasp

SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2009-4962

CVE-2009-4962—

Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a

50RISK

open ↗

Referência

CVE-2017-15663

CVE-2017-15663—

In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The att

28RISK

open ↗

Referência✓ VexDay Proof

OpenRat 0.8-beta4 - 'tpl_dir' Remote File Inclusion

CVE-2008-6403—webappsphp

PHP remote file inclusion vulnerability in themes/default/include/html/insert.inc.php in OpenRat 0.8-beta4 and earlier a

23RISK

open ↗

Referência

CVE-2014-2268

CVE-2014-2268—

views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which all

50RISK

open ↗

Referência

CVE-2015-2460

CVE-2015-2460—

ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,

35RISK

open ↗

Referência

CVE-2010-1465

CVE-2010-1465—

Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitr

50RISK

open ↗

Referência

CVE-2015-7855

CVE-2015-7855—

The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause

35RISK

open ↗

Referência

CVE-2017-15663

CVE-2017-15663—

In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The att

28RISK

open ↗

Referência

CVE-2009-2566

CVE-2009-2566—

Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary cod

50RISK

open ↗

Referência

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting

CVE-2019-14974—webappsphp

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

43RISK

open ↗

Referência

CVE-2010-5081

CVE-2010-5081—

Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code vi

50RISK

open ↗

Referência

CVE-2021-24146

CVE-2021-24146—

Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export

50RISK

open ↗

Referência

CVE-2010-5081

CVE-2010-5081—

Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code vi

50RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.