Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,412cataloged exploits

40,212CVEs with public exploitation

24,696lab-tested

All Referência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 10,014Nuclei 4,547Metasploit 3,531✓ verified onlyrecent popular risk

26,070 exploits

Referência

CVE-2014-8596

CVE-2014-8596—

Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2015-4062

CVE-2015-4062—

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RISK

open ↗

Referência

CVE-2017-18344

CVE-2017-18344—

The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly

23RISK

open ↗

Referência

CVE-2017-3629

CVE-2017-3629—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t

38RISK

open ↗

Referência✓ VexDay Proof

WholeHogSoftware Password Protect - Authentication Bypass

CVE-2009-0459—webappsphp

Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remot

23RISK

open ↗

Referência

CVE-2017-3629

CVE-2017-3629—

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). Supported versions t

38RISK

open ↗

Referência

CVE-2010-2459

CVE-2010-2459—

SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2015-4062

CVE-2015-4062—

SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remo

38RISK

open ↗

Referência

CVE-2009-3754

CVE-2009-3754—

Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote attackers to execute arbitrary SQL commands via the (

23RISK

open ↗

Referência✓ VexDay Proof

Mx Module Smartor Album FAP 2.0 RC 1 - Remote File Inclusion

CVE-2007-2189—webappsphp

PHP remote file inclusion vulnerability in admin/admin_album_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 mod

23RISK

open ↗

Referência✓ VexDay Proof

Quick and Dirty Blog (qdblog) 0.4 - SQL Injection / Local File Inclusion

CVE-2007-2305—webappsphp

Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, a

23RISK

open ↗

Referência✓ VexDay Proof

QuickTicket 1.2 - 'qti_checkname.php' Local File Inclusion

CVE-2007-3547—webappsphp

Directory traversal vulnerability in qti_checkname.php in QuickTicket 1.2 allows remote attackers to include and execute

23RISK

open ↗

Referência

CVE-2004-1719

CVE-2004-1719—

Multiple cross-site scripting (XSS) vulnerabilities in Merak Webmail Server 5.2.7 allow remote attackers to inject arbit

23RISK

open ↗

Referência

CVE-2012-5346

CVE-2012-5346—

Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote atta

23RISK

open ↗

Referência

CVE-2019-11448

CVE-2019-11448—

An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. An unauthenticated user can gain th

28RISK

open ↗

Referência

CVE-2015-10141

CVE-2015-10141CRITICAL

Xdebug Remote Debugger Unauthenticated OS Command Execution

63RISK

open ↗

Referência✓ VexDay Proof

Euphonics Audio Player 1.0 - '.pls' Local Buffer Overflow

CVE-2009-0476—localwindows

Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedi

50RISK

open ↗

Referência

CVE-2014-8358

CVE-2014-8358—

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014)

23RISK

open ↗

Referência

CVE-2015-7241

CVE-2015-7241—

XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.

28RISK

open ↗

Referência✓ VexDay Proof

Extcalendar 2 - 'profile.php' Remote User Pass Change

CVE-2007-0681—webappsphp

profile.php in ExtCalendar 2 and earlier allows remote attackers to change the passwords of arbitrary users without prov

23RISK

open ↗

Referência

CVE-2011-2523

CVE-2011-2523—

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISK

open ↗

Referência

CVE-2017-13847

CVE-2017-13847—

An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. The is

23RISK

open ↗

Referência

CVE-2017-7402

CVE-2017-7402—

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/ind

23RISK

open ↗

Referência

CVE-2019-6272

CVE-2019-6272—

Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attacker

28RISK

open ↗

Referência

CVE-2022-28598

CVE-2022-28598—

Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-contro

23RISK

open ↗

Referência

CVE-2010-2654

CVE-2010-2654—

Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmwar

23RISK

open ↗

Referência

CVE-2010-2670

CVE-2010-2670—

SQL injection vulnerability in recipedetail.php in BrotherScripts Recipe Website allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2010-2673

CVE-2010-2673—

SQL injection vulnerability in profile_view.php in Devana 1.6.6 and earlier allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2010-2674

CVE-2010-2674—

SQL injection vulnerability in index.php in TSOKA:CMS 1.1, 1.9, and 2.0 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2019-6275

CVE-2019-6275—

Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attac

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.