Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,412cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 10,014Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
26,070 exploits
Referência
SPBAS Business Automation Software 2012 - Multiple Vulnerabilities
SPBAS Business Automation Software 2012 has XSS.
23RISK
open ↗Referência✓ VexDay Proof
phpBB Journals System Mod 1.0.2 RC2 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in the Journals System module 1.0.2 (RC2) and earlier for phpBB allow
23RISK
open ↗Referência
CVE-2008-4141
Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to
23RISK
open ↗Referência
CVE-2017-14523
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NO
23RISK
open ↗Referência
CVE-2017-5881
GOM Player 2.3.10.5266 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspeci
23RISK
open ↗Referência
CVE-2012-10046
E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
63RISK
open ↗Referência
CVE-2012-10046
E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
63RISK
open ↗Referência
CVE-2012-10046
E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
63RISK
open ↗Referência
CVE-2017-7398
D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. This enables an attacke
23RISK
open ↗Referência
CVE-2021-3111
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.p
23RISK
open ↗Referência
CVE-2021-3111
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.p
23RISK
open ↗Referência
CVE-2010-2858
Multiple cross-site scripting (XSS) vulnerabilities in news.php in SimpNews 2.47.03 and earlier allow remote attackers t
23RISK
open ↗Referência✓ VexDay Proof
Arab Portal 2.1 (Windows) - Remote File Disclosure
Directory traversal vulnerability in mod.php in Arab Portal 2.1 on Windows allows remote attackers to read arbitrary fil
23RISK
open ↗Referência✓ VexDay Proof
UltraISO 9.3.3.2685 - CCD/IMG Universal Buffer Overflow
Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274 allows remote attackers to cause a denial of service (crash
28RISK
open ↗Referência
CVE-2009-2325
Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a
23RISK
open ↗Referência
CVE-2012-0896
Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remo
43RISK
open ↗Referência
CVE-2009-4385
Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers
23RISK
open ↗Referência
CVE-2010-1473
Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attacker
38RISK
open ↗Referência
CVE-2010-1473
Directory traversal vulnerability in the Advertising (com_advertising) component 0.25 for Joomla! allows remote attacker
38RISK
open ↗Referência✓ VexDay Proof
Simplog 0.9.2 - 's' Remote Command Execution
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple
28RISK
open ↗Referência✓ VexDay Proof
Anthologia 0.5.2 - 'index.php?ads_file' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Anthologia 0.5.2 allows remote attackers to execute arbitrary PH
23RISK
open ↗Referência✓ VexDay Proof
PHPMyInventory 2.8 - 'global.inc.php' Remote File Inclusion
PHP remote file inclusion vulnerability in Includes/global.inc.php in phpMyInventory 2.8 allows remote attackers to exec
23RISK
open ↗Referência
CVE-2020-12504
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
48RISK
open ↗Referência
CVE-2020-12504
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
48RISK
open ↗Referência
CVE-2011-5012
Heap-based buffer overflow in the Reflection FTP Client (rftpcom.dll 7.2.0.106 and possibly other versions), as used in
23RISK
open ↗Referência
CVE-2016-9018
Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and c
23RISK
open ↗Referência
CVE-2012-0933
Multiple cross-site scripting (XSS) vulnerabilities in Acidcat CMS 3.5.1, 3.5.2, 3.5.6, and possibly earlier allow remot
23RISK
open ↗Referência
CVE-2009-4413
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remot
23RISK
open ↗Referência
CVE-2013-4810
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle
100RISK
open ↗Referência
CVE-2016-5845
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to ca
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.