Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits

34,432CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

21,497 exploits

Referência

CVE-2017-17055

CVE-2017-17055—

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site

23RISK

open ↗

Referência

CVE-2017-17055

CVE-2017-17055—

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site

23RISK

open ↗

Referência

CVE-2018-25120

CVE-2018-25120CRITICAL

D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test

48RISK

open ↗

Referência

CVE-2018-25120

CVE-2018-25120CRITICAL

D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test

48RISK

open ↗

Referência✓ VexDay Proof

Axigen 2.0.0b1 - Remote Denial of Service (1)

CVE-2007-0886—doslinux

Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (applic

23RISK

open ↗

Referência

CVE-2018-25120

CVE-2018-25120CRITICAL

D-Link DNS-343 ShareCenter <= 1.05 Command Injection via /goform/Mail_Test

48RISK

open ↗

Referência

CVE-2011-2757

CVE-2011-2757—

Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remot

50RISK

open ↗

Referência

CVE-2016-5678

CVE-2016-5678—

NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows re

23RISK

open ↗

Referência

CVE-2021-26828

CVE-2021-26828HIGHunder attack

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe

83RISK

open ↗

Referência

CVE-2020-25494

CVE-2020-25494—

Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou

35RISK

open ↗

Referência

CVE-2012-6500

CVE-2012-6500—

Directory traversal vulnerability in download.lib.php in Pragyan CMS 3.0 and earlier allows remote attackers to read arb

23RISK

open ↗

Referência

CVE-2009-5109

CVE-2009-5109—

Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long e

50RISK

open ↗

Referência

CVE-2004-2116

CVE-2004-2116—

Directory traversal vulnerability in Tiny Server 1.1 allows remote attackers to read or download arbitrary files via a .

23RISK

open ↗

Referência

CVE-2009-5109

CVE-2009-5109—

Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long e

50RISK

open ↗

Referência

CVE-2009-2550

CVE-2009-2550—

Stack-based buffer overflow in Hamster Audio Player 0.3a allows remote attackers to execute arbitrary code via a long st

23RISK

open ↗

Referência

CVE-2009-2550

CVE-2009-2550—

Stack-based buffer overflow in Hamster Audio Player 0.3a allows remote attackers to execute arbitrary code via a long st

23RISK

open ↗

Referência

CVE-2010-3313

CVE-2010-3313—

phpgwapi/js/fckeditor/editor/dialog/fck_spellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.

23RISK

open ↗

Referência

CVE-2015-7622

CVE-2015-7622—

Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.

28RISK

open ↗

Referência

CVE-2016-0051

CVE-2016-0051—

The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window

43RISK

open ↗

Referência

CVE-2012-0406

CVE-2012-0406—

The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows re

23RISK

open ↗

Referência✓ VexDay Proof

IrfanView 4.10 - '.fpx' Memory Corruption

CVE-2008-0493—localwindows

fpx.dll 3.9.8.0 in the FlashPix plugin for IrfanView 4.10 allows remote attackers to execute arbitrary code via a crafte

23RISK

open ↗

Referência✓ VexDay Proof

NewsOffice 1.1 - Remote File Inclusion

CVE-2008-1903—webappsphp

PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enab

35RISK

open ↗

Referência✓ VexDay Proof

Chilkat XML - ActiveX Arbitrary File Creation/Execution

CVE-2008-4343—remotewindows

The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to cr

23RISK

open ↗

Referência

CVE-2006-6958

CVE-2006-6958—

Multiple PHP remote file inclusion vulnerabilities in phpBlueDragon 2.9.1 allow remote attackers to execute arbitrary PH

23RISK

open ↗

Referência

CVE-2016-0051

CVE-2016-0051—

The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window

43RISK

open ↗

Referência

CVE-2009-5109

CVE-2009-5109—

Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long e

50RISK

open ↗

Referência

CVE-2018-5262

CVE-2018-5262—

A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute

35RISK

open ↗

Referência

CVE-2009-2620

CVE-2009-2620—

src/remote/server.cpp in fbserver.exe in Firebird SQL 1.5 before 1.5.6, 2.0 before 2.0.6, 2.1 before 2.1.3, and 2.5 befo

23RISK

open ↗

Referência

CVE-2022-46604

CVE-2022-46604HIGH

An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanis

41RISK

open ↗

Referência

CVE-2018-17776

CVE-2018-17776—

PCProtect Anti-Virus v4.8.35 has "Everyone: (F)" permission for %PROGRAMFILES(X86)%\PCProtect, which allows local users

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.