Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

25,989 exploits

Referência

CVE-2016-5679

CVE-2016-5679—

cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticat

28RISK

open ↗

Referência

CVE-2003-0264

CVE-2003-0264—

Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg

60RISK

open ↗

Referência

CVE-2016-9838

CVE-2016-9838—

An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of

28RISK

open ↗

Referência

CVE-2017-9080

CVE-2017-9080—

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile

50RISK

open ↗

Referência

CVE-2018-9842

CVE-2018-9842—

CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay

28RISK

open ↗

Referência

CVE-2019-4013

CVE-2019-4013CRITICAL

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr

53RISK

open ↗

Referência✓ VexDay Proof

Pre Shopping Mall - Insecure Cookie Handling

CVE-2008-6232—webappsphp

Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adm

23RISK

open ↗

Referência✓ VexDay Proof

32bit FTP (09.04.24) - 'Banner' Remote Buffer Overflow (PoC)

CVE-2009-1592—doswindows_x86

Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a

23RISK

open ↗

Referência

CVE-2009-4696

CVE-2009-4696—

SQL injection vulnerability in index.php in RadNICS Gold 5 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2012-5106

CVE-2012-5106—

Stack-based buffer overflow in FreeFloat FTP Server 1.0 allows remote authenticated users to execute arbitrary code via

28RISK

open ↗

Referência✓ VexDay Proof

SCart 2.0 - 'page' Remote Code Execution

CVE-2006-7012—webappsphp

scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parame

23RISK

open ↗

Referência

CVE-2010-1305

CVE-2010-1305—

Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly ot

43RISK

open ↗

Referência

CVE-2010-1431

CVE-2010-1431—

SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2010-1307

CVE-2010-1307—

Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers

43RISK

open ↗

Referência

CVE-2013-4212

CVE-2013-4212—

Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute

60RISK

open ↗

Referência

CVE-2015-2068

CVE-2015-2068—

Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server a

43RISK

open ↗

Referência

CVE-2018-9842

CVE-2018-9842—

CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay

28RISK

open ↗

Referência

CVE-2019-6445

CVE-2019-6445—

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd

28RISK

open ↗

Referência

CVE-2018-9842

CVE-2018-9842—

CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay

28RISK

open ↗

Referência✓ VexDay Proof

Aconon Mail 2004 - Directory Traversal

CVE-2008-0464—webappscgi

Directory traversal vulnerability in archiv.cgi in absofort aconon Mail 2007 Enterprise SQL 11.7.0 and Mail 2004 Enterpr

23RISK

open ↗

Referência✓ VexDay Proof

Mambo Component com_Musica - 'id' SQL Injection

CVE-2008-6234—webappsphp

SQL injection vulnerability in the com_musica module in Joomla! and Mambo allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência

CVE-2011-0354

CVE-2011-0354—

The default configuration of Cisco Tandberg C Series Endpoints, and Tandberg E and EX Personal Video units, with softwar

28RISK

open ↗

Referência

CVE-2011-4107

CVE-2011-4107—

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7

28RISK

open ↗

Referência

CVE-2011-4875

CVE-2011-4875—

Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC

28RISK

open ↗

Referência

CVE-2010-0467

CVE-2010-0467—

Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attac

50RISK

open ↗

Referência

CVE-2010-1308

CVE-2010-1308—

Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read a

43RISK

open ↗

Referência

CVE-2026-90700

CVE-2026-90700MEDIUM

itsourcecode Sales and Inventory System pro_edit1.php sql injection

33RISK

open ↗

Referência

CVE-2017-9080

CVE-2017-9080—

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile

50RISK

open ↗

Referência

CVE-2019-1347

CVE-2019-1347—

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Servi

28RISK

open ↗

Referência✓ VexDay Proof

Leap CMS 0.1.4 - SQL Injection / Cross-Site Scripting / Arbitrary File Upload

CVE-2009-1614—webappsphp

Multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web scr

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.