Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,558cataloged exploits
40,283CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,865VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
26,110 exploits
Referência✓ VexDay Proof
A-shop 0.70 - Remote File Deletion
CVE-2007-3936—webappsasp
Directory traversal vulnerability in admin/filebrowser.asp in A-shop 0.70 and earlier, and possibly 0.71, allows remote
23RISK
open ↗
Referência
CVE-2012-4234
CVE-2012-4234—
Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum be
23RISK
open ↗
Referência
CVE-2016-3670
CVE-2016-3670—
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1
23RISK
open ↗
Referência
CVE-2020-20140
CVE-2020-20140—
Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Cha
23RISK
open ↗
Referência
CVE-2013-2097
CVE-2013-2097—
ZPanel through 10.1.0 has Remote Command Execution
43RISK
open ↗
Referência✓ VexDay Proof
TurnkeyForms Local Classifieds - Cross-Site Scripting / SQL Injection
CVE-2008-6351—webappsphp
Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to in
23RISK
open ↗
Referência
CVE-2014-3443
CVE-2014-3443—
JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg
23RISK
open ↗
Referência
CVE-2013-2143
CVE-2013-2143—
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update
50RISK
open ↗
Referência
CVE-2011-5147
CVE-2011-5147—
Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeW
23RISK
open ↗
Referência
CVE-2017-1297
CVE-2017-1297—
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-bas
23RISK
open ↗
Referência
CVE-2013-10034
CVE-2013-10034CRITICAL
Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2013-10034
CVE-2013-10034CRITICAL
Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2013-10034
CVE-2013-10034CRITICAL
Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE
63RISK
open ↗
Referência
CVE-2015-7894
CVE-2015-7894—
The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allow
23RISK
open ↗
Referência✓ VexDay Proof
SMA-DB 0.3.13 - Multiple Remote File Inclusions
CVE-2009-1452—webappsphp
Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execut
23RISK
open ↗
Referência
CVE-2009-3216
CVE-2009-3216—
Multiple directory traversal vulnerabilities in iWiccle 1.01, when magic_quotes_gpc is disabled, allow remote attackers
23RISK
open ↗
Referência
CVE-2009-3759
CVE-2009-3759—
Multiple cross-site request forgery (CSRF) vulnerabilities in sample code in the XenServer Resource Kit in Citrix XenCen
23RISK
open ↗
Referência
CVE-2010-0976
CVE-2010-0976—
Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers
23RISK
open ↗
Referência
CVE-2010-0976
CVE-2010-0976—
Acidcat CMS 3.5.x does not prevent access to install.asp after installation finishes, which might allow remote attackers
23RISK
open ↗
Referência
CVE-2010-2655
CVE-2010-2655—
Directory traversal vulnerability in private/file_management.php on the IBM BladeCenter with Advanced Management Module
23RISK
open ↗
Referência
CVE-2010-5281
CVE-2010-5281—
Directory traversal vulnerability in ibrowser.php in the CMScout 2.09 IBrowser TinyMCE Plugin 1.4.1, when magic_quotes_g
23RISK
open ↗
Referência✓ VexDay Proof
Harpia CMS 1.0.5 - Remote File Inclusion
CVE-2006-7024—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arb
23RISK
open ↗
Referência✓ VexDay Proof
Thyme Calendar 1.3 - SQL Injection
CVE-2007-2621—webappsphp
SQL injection vulnerability in event_view.php in Thyme Calendar 1.3 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke platinum 7.6.b.5 - Remote File Inclusion
CVE-2007-5676—webappsphp
PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attac
23RISK
open ↗
Referência
CVE-2018-15686
CVE-2018-15686HIGH
systemd: reexec state injection: fgets() on overlong lines leads to line splitting
41RISK
open ↗
Referência
CVE-2019-6588
CVE-2019-6588—
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsani
23RISK
open ↗
Referência✓ VexDay Proof
PHPSpamManager 0.53b - 'body.php' Remote File Disclosure
CVE-2008-1645—webappsphp
Directory traversal vulnerability in body.php in phpSpamManager (phpSM) 0.53 beta allows remote attackers to read arbitr
23RISK
open ↗
Referência
CVE-2013-4946
CVE-2013-4946—
Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remote attackers t
23RISK
open ↗
Referência
CVE-2013-5311
CVE-2013-5311—
Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2015-4852
CVE-2015-4852CRITICALunder attack
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
100RISK
open ↗
← previouspage 227 / 871next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.