Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

72,018cataloged exploits

32,219CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 20,023GitHub PoC 13,334VulnCheck XDB 8,195Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

20,023 exploits

Referência

CVE-2015-6567

CVE-2015-6567—

Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/

28RISK

open ↗

Referência

CVE-2017-3006

CVE-2017-3006—

Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions durin

28RISK

open ↗

Referência

CVE-2018-6228

CVE-2018-6228—

A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to exe

28RISK

open ↗

Referência

CVE-2018-6229

CVE-2018-6229—

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker

28RISK

open ↗

Referência

Oreon 1.4 / Centreon 1.4.1 - Multiple Remote File Inclusion Vulnerabilities

CVE-2007-6485—

Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute a

28RISK

open ↗

Referência

CVE-2020-15160

CVE-2020-15160—

Blind SQL Injection in PrestaShop

28RISK

open ↗

Referência

CVE-2019-16702

CVE-2019-16702—

Integard Pro 2.2.0.9026 allows remote attackers to execute arbitrary code via a buffer overflow involving a long NoJs pa

28RISK

open ↗

Referência

CVE-2010-1299

CVE-2010-1299—

Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is di

28RISK

open ↗

Referência

CVE-2010-1299

CVE-2010-1299—

Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is di

28RISK

open ↗

Referência

Visual Events Calendar 1.1 - 'cfg_dir' Remote File Inclusion

CVE-2006-4060—

PHP remote file inclusion vulnerability in calendar.php in Visual Events Calendar 1.1 allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2015-5452

CVE-2015-5452—

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

CVE-2015-5452

CVE-2015-5452—

SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr

23RISK

open ↗

Referência

Serv-U FTP Server 7.3 - (Authenticated) Remote FTP File Replacement

CVE-2008-4501—

Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote auth

28RISK

open ↗

Referência

CVE-2017-1000083

CVE-2017-1000083—

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

50RISK

open ↗

Referência

CVE-2017-7461

CVE-2017-7461—

Directory traversal vulnerability in the web-based management site on the Intellinet NFC-30ir IP Camera with firmware LM

28RISK

open ↗

Referência

StreamAudio ChainCast ProxyManager - 'ccpm_0237.dll' Remote Buffer Overflow

CVE-2008-0248—

Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to

28RISK

open ↗

Referência

CVE-2012-3588

CVE-2012-3588—

Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attacke

28RISK

open ↗

Referência

CCProxy 6.2 - 'ping' Remote Buffer Overflow

CVE-2004-2685—

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre

28RISK

open ↗

Referência

CCProxy 6.2 - Telnet Proxy Ping Overflow (Metasploit)

CVE-2004-2685—

Buffer overflow in YoungZSoft CCProxy 6.2 and earlier allows remote attackers to execute arbitrary code via a long addre

28RISK

open ↗

Referência

CVE-2021-28419

CVE-2021-28419—

The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads

28RISK

open ↗

Referência

CVE-2022-38841

CVE-2022-38841HIGH

Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagn

46RISK

open ↗

Referência

CVE-2015-3205

CVE-2015-3205—

libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file,

28RISK

open ↗

Referência

CVE-2015-3205

CVE-2015-3205—

libmimedir allows remote attackers to execute arbitrary code via a VCF file with two NULL bytes at the end of the file,

28RISK

open ↗

Referência

CVE-2018-14328

CVE-2018-14328—

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti

28RISK

open ↗

Referência

CVE-2018-12908

CVE-2018-12908—

Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti

28RISK

open ↗

Referência

CVE-2022-4681

CVE-2022-4681CRITICAL

Hide My WP < 6.2.9 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2009-3115

CVE-2009-3115—

SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a c

28RISK

open ↗

Referência

CVE-2017-15806

CVE-2017-15806—

The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the s

28RISK

open ↗

Referência

CVE-2017-20216

CVE-2017-20216CRITICAL

FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection

53RISK

open ↗

Referência

CVE-2017-17095

CVE-2017-17095—

tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (TIFFSetupStrips heap-b

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.