Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits

40,258CVEs with public exploitation

24,696lab-tested

All Referência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,095 exploits

Referência

CVE-2017-16952

CVE-2017-16952—

KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.

23RISK

open ↗

Referência

CVE-2019-3759

CVE-2019-3759MEDIUM

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 cont

33RISK

open ↗

Referência✓ VexDay Proof

Amber Script 1.0 - 'show_content.php?id' Local File Inclusion

CVE-2007-6129—webappsphp

Directory traversal vulnerability in scripts/include/show_content.php in Amber Script 1.0 allows remote attackers to inc

23RISK

open ↗

Referência

CVE-2015-3325

CVE-2015-3325—

SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS mod_gallery Zend_Hash_key + Extract - Remote File Inclusion

CVE-2008-0138—webappsphp

PHP remote file inclusion vulnerability in xoopsgallery/init_basic.php in the mod_gallery module for XOOPS, when registe

23RISK

open ↗

Referência✓ VexDay Proof

STWC-Counter 3.4.0 - 'downloadcounter.php' Remote File Inclusion

CVE-2007-1233—webappsphp

PHP remote file inclusion vulnerability in downloadcounter.php in STWC-Counter 3.4.0.0 and earlier allows remote attacke

23RISK

open ↗

Referência✓ VexDay Proof

FlashBlog 0.31b - Arbitrary File Upload

CVE-2008-2574—webappsphp

Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to e

23RISK

open ↗

Referência✓ VexDay Proof

NUVICO DVR NVDV4 / PdvrAtl Module 'PdvrAtl.DLL 1.0.1.25' - Remote Buffer Overflow

CVE-2008-4547—remotewindows

Heap-based buffer overflow in the PdvrAtl.PdvrOcx.1 ActiveX control (pdvratl.dll) in DVRHOST Web CMS OCX 1.0.1.25 allows

28RISK

open ↗

Referência✓ VexDay Proof

LimeSurvey (phpsurveyor) 1.49rc2 - Remote File Inclusion

CVE-2007-3632—webappsphp

Multiple PHP remote file inclusion vulnerabilities in LimeSurvey (aka PHPSurveyor) 1.49RC2 allow remote attackers to exe

35RISK

open ↗

Referência✓ VexDay Proof

PHPMesFilms 1.0 - 'index.php?id' SQL Injection

CVE-2009-0598—webappsphp

SQL injection vulnerability in index.php in PhpMesFilms 1.0 and 1.8 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2010-3462

CVE-2010-3462—

Cross-site scripting (XSS) vulnerability in backend/plugin/Registration/index.php in Mollify 1.6, 1.6.5.5, and possibly

23RISK

open ↗

Referência

CVE-2016-9488

CVE-2016-9488—

ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities

23RISK

open ↗

Referência

CVE-2017-9812

CVE-2017-9812—

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus f

28RISK

open ↗

Referência

CVE-2019-7439

CVE-2019-7439—

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.

23RISK

open ↗

Referência

CVE-2017-16953

CVE-2017-16953—

connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to mo

28RISK

open ↗

Referência✓ VexDay Proof

FreeBSD 7.0-RELEASE - Telnet Daemon Privilege Escalation

CVE-2009-0641—localfreebsd

sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a metho

23RISK

open ↗

Referência

CVE-2018-14418

CVE-2018-14418—

In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.

23RISK

open ↗

Referência✓ VexDay Proof

Simple PHP News 1.0 - Remote Command Execution

CVE-2009-0643—webappsphp

Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary

23RISK

open ↗

Referência

CVE-2009-2764

CVE-2009-2764—

Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of

28RISK

open ↗

Referência

CVE-2009-3254

CVE-2009-3254—

Multiple stack-based buffer overflows in Ultimate Player 1.56 beta allow remote attackers to execute arbitrary code via

23RISK

open ↗

Referência

CVE-2009-3960

CVE-2009-3960MEDIUMunder attackransomware

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Service

100RISK

open ↗

Referência

CVE-2010-1345

CVE-2010-1345—

Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote a

43RISK

open ↗

Referência

CVE-2019-25750

CVE-2019-25750HIGH

Joomla J-MultipleHotelReservation 6.0.7 SQL Injection

41RISK

open ↗

Referência

CVE-2010-1350

CVE-2010-1350—

SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers

23RISK

open ↗

Referência

CVE-2010-1353

CVE-2010-1353—

Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to re

43RISK

open ↗

Referência

CVE-2010-3468

CVE-2010-3468—

Directory traversal vulnerability in fileManager.cfc in Mura CMS 5.1 before 5.1.498 and 5.2 before 5.2.2809, and Sava CM

23RISK

open ↗

Referência

CVE-2010-4945

CVE-2010-4945—

SQL injection vulnerability in the CamelcityDB (com_camelcitydb2) component 2.2 for Joomla! allows remote attackers to e

23RISK

open ↗

Referência

CVE-2017-9812

CVE-2017-9812—

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus f

28RISK

open ↗

Referência

CVE-2019-7439

CVE-2019-7439—

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.

23RISK

open ↗

Referência✓ VexDay Proof

Simplog 0.9.2 - 's' Remote Command Execution

CVE-2006-1776—webappsphp

PHP remote file inclusion vulnerability in doc/index.php in Jeremy Ashcraft Simplog 0.9.2 and earlier allows remote atta

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.