Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,589cataloged exploits
34,508CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,554GitHub PoC 13,689VulnCheck XDB 8,216Nuclei 4,223Metasploit 3,464✓ verified onlyrecentpopularrisk
21,554 exploits
Referência
CVE-2010-5028
CVE-2010-5028—
SQL injection vulnerability in the JExtensions JE Job (com_jejob) component 1.0 for Joomla! allows remote attackers to e
38RISK
open ↗
Referência
CVE-2015-1480
CVE-2015-1480—
ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive tic
23RISK
open ↗
Referência
CVE-2015-1480
CVE-2015-1480—
ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive tic
23RISK
open ↗
Referência
CVE-2015-2824
CVE-2015-2824—
Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attacke
23RISK
open ↗
Referência
CVE-2015-2824
CVE-2015-2824—
Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attacke
23RISK
open ↗
Referência
CVE-2010-1353
CVE-2010-1353—
Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to re
43RISK
open ↗
Referência
CVE-2009-2334
CVE-2009-2334—
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access t
23RISK
open ↗
Referência
CVE-2017-13798
CVE-2017-13798—
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Referência
CVE-2014-4034
CVE-2014-4034—
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2014-4034
CVE-2014-4034—
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2014-4034
CVE-2014-4034—
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2015-1578
CVE-2015-1578—
Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web s
23RISK
open ↗
Referência
CVE-2015-7986
CVE-2015-7986—
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a deni
23RISK
open ↗
Referência✓ VexDay Proof
Flip 3.0 - Remote Password Hash Disclosure
CVE-2007-5063—webappsphp
Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, w
23RISK
open ↗
Referência✓ VexDay Proof
Rayzz Script 2.0 - Local/Remote File Inclusion
CVE-2007-6230—webappsphp
Directory traversal vulnerability in common/classes/class_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attack
23RISK
open ↗
Referência✓ VexDay Proof
Flat PHP Board 1.2 - Multiple Vulnerabilities
CVE-2007-6395—webappsphp
Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which a
23RISK
open ↗
Referência✓ VexDay Proof
Power Editor 2.0 - Remote File Disclosure / Edit
CVE-2008-2115—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in editor.php in ScriptsEZ.net Power Editor 2.0 allow remote attacke
23RISK
open ↗
Referência✓ VexDay Proof
TmaxSoft JEUS - Alternate Data Streams File Disclosure
CVE-2008-6528—remotewindows
NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to t
23RISK
open ↗
Referência
CVE-2015-7986
CVE-2015-7986—
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a deni
23RISK
open ↗
Referência
CVE-2010-0390
CVE-2010-0390—
Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is no
23RISK
open ↗
Referência
CVE-2010-4863
CVE-2010-4863—
Cross-site scripting (XSS) vulnerability in admin/changedata.php in GetSimple CMS 2.01 allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2012-4250
CVE-2012-4250—
Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls
23RISK
open ↗
Referência
CVE-2015-4594
CVE-2015-4594—
eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the a
23RISK
open ↗
Referência
CVE-2015-4594
CVE-2015-4594—
eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the a
23RISK
open ↗
Referência
CVE-2019-12616
CVE-2019-12616—
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF
28RISK
open ↗
Referência
CVE-2023-28288
CVE-2023-28288HIGH
Microsoft SharePoint Server Spoofing Vulnerability
41RISK
open ↗
Referência
CVE-2018-0952
CVE-2018-0952—
An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary
23RISK
open ↗
Referência
CVE-2010-0802
CVE-2010-0802—
SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote a
23RISK
open ↗
Referência
CVE-2012-2593
CVE-2012-2593—
Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote atta
23RISK
open ↗
Referência
CVE-2010-0802
CVE-2010-0802—
SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote a
23RISK
open ↗
← previouspage 200 / 719next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.