Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
20,003 exploits
Referência
CVE-2010-2682
CVE-2010-2682—
Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote a
43RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2018-9958
CVE-2018-9958—
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1
50RISK
open ↗
Referência
CVE-2011-0917
CVE-2011-0917—
Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in
28RISK
open ↗
Referência
CVE-2014-4158
CVE-2014-4158—
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISK
open ↗
Referência
CVE-2014-4158
CVE-2014-4158—
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISK
open ↗
Referência
CVE-2014-4158
CVE-2014-4158—
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a GET req
28RISK
open ↗
Referência
CVE-2015-7246
CVE-2015-7246—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RISK
open ↗
Referência
CVE-2015-7246
CVE-2015-7246—
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RISK
open ↗
Referência
CVE-2010-3132
CVE-2010-3132—
Untrusted search path vulnerability in Adobe Dreamweaver CS5 11.0 build 4916, build 4909, and probably other versions, a
28RISK
open ↗
Referência
CVE-2023-36812
CVE-2023-36812CRITICAL
Remote Code Execution in OpenTSDB
68RISK
open ↗
Referência
wPortfolio 0.3 - Arbitrary File Upload
CVE-2008-5220—
Unrestricted file upload vulnerability in admin/upload_form.php in wPortfolio 0.3 and earlier allows remote attackers to
28RISK
open ↗
Referência
Poppler 0.8.4 - libpoppler Uninitialized pointer Code Execution
CVE-2008-2950—
The Page destructor in Page.cc in libpoppler in Poppler 0.8.4 and earlier deletes a pageWidgets object even if it is not
28RISK
open ↗
Referência
CVE-2018-0710
CVE-2018-0710—
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authe
28RISK
open ↗
Referência
CVE-2018-0710
CVE-2018-0710—
Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authe
28RISK
open ↗
Referência
CVE-2018-17442
CVE-2018-17442—
An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. An unrestricted file upload vulnerabili
28RISK
open ↗
Referência
CVE-2017-11154
CVE-2017-11154—
Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-296
28RISK
open ↗
Referência
CVE-2014-5446
CVE-2014-5446—
Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2
35RISK
open ↗
Referência
CVE-2019-7751
CVE-2019-7751—
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, for
28RISK
open ↗
Referência
CVE-2018-16283
CVE-2018-16283—
The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
50RISK
open ↗
Referência
CVE-2012-0911
CVE-2012-0911—
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted
50RISK
open ↗
Referência
CVE-2012-0911
CVE-2012-0911—
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted
50RISK
open ↗
Referência
MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal
CVE-2019-7751—
A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, for
28RISK
open ↗
Referência
Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC)
CVE-2009-1511—
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file tha
28RISK
open ↗
Referência
FutureSoft TFTP Server 2000 - Remote Overwrite (SEH)
CVE-2007-1645—
Buffer overflow in FutureSoft TFTP Server 2000 on Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrar
28RISK
open ↗
Referência
CVE-2020-10181
CVE-2020-10181CRITICALunder attack
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevate
83RISK
open ↗
Referência
CVE-2017-9347
CVE-2017-9347—
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/d
28RISK
open ↗
Referência
CVE-2020-8416
CVE-2020-8416—
IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to th
28RISK
open ↗
Referência
CVE-2015-7944
CVE-2015-7944—
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11
28RISK
open ↗
← previouspage 129 / 667next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.