Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

25,989 exploits

Referência✓ VexDay Proof

campus virtual-lms - Cross-Site Scripting / SQL Injection

CVE-2009-2150—webappsphp

Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack th

23RISK

open ↗

Referência

CVE-2012-1593

CVE-2012-1593—

epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows r

28RISK

open ↗

Referência

CVE-2013-7246

CVE-2013-7246—

Buffer overflow in the IconCreate method in an ActiveX control in the DaumGame ActiveX plugin 1.1.0.4 and 1.1.0.5 allows

28RISK

open ↗

Referência✓ VexDay Proof

Bytehoard 2.1 - 'server.php' Remote File Inclusion

CVE-2006-2849—webappsphp

PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attac

28RISK

open ↗

Referência✓ VexDay Proof

Site@School 2.4.02 - Arbitrary File Upload

CVE-2006-4920—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Site@School (S@S) 2.4.02 and earlier allow remote attackers to exe

28RISK

open ↗

Referência

CVE-2014-5468

CVE-2014-5468—

A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cf

50RISK

open ↗

Referência

CVE-2020-15261

CVE-2020-15261HIGH

Unquoted service path vulnerability on Veyon

46RISK

open ↗

Referência

CVE-2015-2097

CVE-2015-2097—

Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c

28RISK

open ↗

Referência✓ VexDay Proof

Affiliate Software Java 4.0 - Authentication Bypass

CVE-2008-6366—webappsasp

SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to e

23RISK

open ↗

Referência

CVE-2015-4632

CVE-2015-4632—

Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08

50RISK

open ↗

Referência

CVE-2016-3288

CVE-2016-3288—

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet E

35RISK

open ↗

Referência

CVE-2018-0946

CVE-2018-0946—

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

35RISK

open ↗

Referência

CVE-2009-2219

CVE-2009-2219—

Multiple cross-site scripting (XSS) vulnerabilities in phpCollegeExchange 0.1.5c allow remote attackers to inject arbitr

23RISK

open ↗

Referência

CVE-2010-2456

CVE-2010-2456—

Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read a

23RISK

open ↗

Referência

CVE-2015-4632

CVE-2015-4632—

Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08

50RISK

open ↗

Referência

CVE-2010-2458

CVE-2010-2458—

Cross-site scripting (XSS) vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attacke

23RISK

open ↗

Referência

CVE-2015-2097

CVE-2015-2097—

Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c

28RISK

open ↗

Referência

CVE-2010-0610

CVE-2010-0610—

Multiple SQL injection vulnerabilities in the Photoblog (com_photoblog) component for Joomla! allow remote attackers to

23RISK

open ↗

Referência

CVE-2011-1761

CVE-2011-1761—

Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in l

28RISK

open ↗

Referência

CVE-2013-6221

CVE-2013-6221—

Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoP

60RISK

open ↗

Referência

CVE-2008-6376

CVE-2008-6376—

SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the passw

23RISK

open ↗

Referência

CVE-2021-27973

CVE-2021-27973—

SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.

28RISK

open ↗

Referência

CVE-2010-2462

CVE-2010-2462—

SQL injection vulnerability in withdraw_money.php in Toma Cero OroHYIP allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2017-17867

CVE-2017-17867—

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying th

28RISK

open ↗

Referência

CVE-2017-7397

CVE-2017-7397—

BackBox Linux 4.6 allows remote attackers to cause a denial of service (ksoftirqd CPU consumption) via a flood of packet

28RISK

open ↗

Referência

CVE-2019-6208

CVE-2019-6208—

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Moja

23RISK

open ↗

Referência

CVE-2017-6320

CVE-2017-6320—

A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (20

28RISK

open ↗

Referência

CVE-2018-12053

CVE-2018-12053—

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.p

28RISK

open ↗

Referência

CVE-2010-2464

CVE-2010-2464—

Multiple cross-site scripting (XSS) vulnerabilities in the RSComments (com_rscomments) component 1.0.0 Rev 2 for Joomla!

23RISK

open ↗

Referência

CVE-2010-2610

CVE-2010-2610—

Multiple SQL injection vulnerabilities in 2daybiz Job Site Script allow remote attackers to execute arbitrary SQL comman

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.