Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,624 exploits
Referência
CVE-2017-6411
CVE-2017-6411—
Cross Site Request Forgery (CSRF) on D-Link DSL-2730U C1 IN_1.00 devices allows remote attackers to change the DNS or fi
23RISK
open ↗
Referência
CVE-2019-6146
CVE-2019-6146—
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host heade
23RISK
open ↗
Referência✓ VexDay Proof
neuron news 1.0 - 'index.php?q' Local File Inclusion
CVE-2007-5050—webappsphp
Directory traversal vulnerability in index.php in Neuron News 1.0 allows remote attackers to include and execute arbitra
23RISK
open ↗
Referência
CVE-2016-9018
CVE-2016-9018—
Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and c
23RISK
open ↗
Referência✓ VexDay Proof
PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
CVE-2007-5069—webappsphp
Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows re
23RISK
open ↗
Referência
CVE-2017-9767
CVE-2017-9767—
Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inj
23RISK
open ↗
Referência
CVE-2010-1742
CVE-2010-1742—
Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência
CVE-2010-1742
CVE-2010-1742—
Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web sc
23RISK
open ↗
Referência✓ VexDay Proof
LiteNews 0.1 - Insecure Cookie Handling
CVE-2008-3508—webappsphp
LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers to bypass authentication and gain administr
23RISK
open ↗
Referência
CVE-2017-9767
CVE-2017-9767—
Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inj
23RISK
open ↗
Referência
CVE-2009-4753
CVE-2009-4753—
Multiple buffer overflows in the FTP server on the Addonics NAS Adapter NASU2FW41 with loader 1.17 allow remote attacker
23RISK
open ↗
Referência
CVE-2019-6249
CVE-2019-6249—
An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/inde
23RISK
open ↗
Referência
CVE-2017-7056
CVE-2017-7056—
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo
23RISK
open ↗
Referência
CVE-2021-31642
CVE-2021-31642—
A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including B
35RISK
open ↗
Referência
CVE-2021-31674
CVE-2021-31674—
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacke
23RISK
open ↗
Referência
CVE-2021-31761
CVE-2021-31761—
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's ru
35RISK
open ↗
Referência
CVE-2021-32172
CVE-2021-32172—
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the
50RISK
open ↗
Referência
Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass
CVE-2021-3278—webappsmultiple
Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection
28RISK
open ↗
Referência
CVE-2021-3291
CVE-2021-3291—
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the mod
28RISK
open ↗
Referência
CASAP Automated Enrollment System 1.0 - 'First Name' Stored XSS
CVE-2021-3294—webappsphp
CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a co
23RISK
open ↗
Referência
CVE-2010-1924
CVE-2010-1924—
SQL injection vulnerability in index.php in Hi Web Wiesbaden Live Shopping Multi Portal System allows remote attackers t
23RISK
open ↗
Referência
CVE-2018-5754
CVE-2018-5754—
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and
23RISK
open ↗
Referência
CVE-2018-5754
CVE-2018-5754—
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and
23RISK
open ↗
Referência
CVE-2019-6710
CVE-2019-6710—
Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
23RISK
open ↗
Referência
CVE-2018-12114
CVE-2018-12114—
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
23RISK
open ↗
Referência
CVE-2019-19245
CVE-2019-19245—
NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[use
23RISK
open ↗
Referência
CVE-2016-2539
CVE-2016-2539—
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to
23RISK
open ↗
Referência
CVE-2016-2539
CVE-2016-2539—
Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to
23RISK
open ↗
Referência
CVE-2022-45717
CVE-2022-45717CRITICAL
IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName param
48RISK
open ↗
Referência
CVE-2022-45709
CVE-2022-45709CRITICAL
IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLev
48RISK
open ↗
← previouspage 245 / 721next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.