Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,008cataloged exploits

34,638CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecent popular risk

21,624 exploits

Referência

CVE-2009-3123

CVE-2009-3123—

Directory traversal vulnerability in gallery/gallery.php in Wap-Motor before 18.1 allows remote attackers to read arbitr

23RISK

open ↗

Referência✓ VexDay Proof

WebCreator 0.2.6-rc3 - 'moddir' Remote File Inclusion

CVE-2007-1459—webappsphp

Multiple PHP remote file inclusion vulnerabilities in WebCreator 0.2.6-rc3 and earlier allow remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

hosting controller 6.1 hot fix 3.3 - Multiple Vulnerabilities

CVE-2007-6502—webappsasp

Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1)

23RISK

open ↗

Referência✓ VexDay Proof

PowerBook 1.21 - 'index.php' Local File Inclusion

CVE-2008-1537—webappsphp

Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

Multi-Page Comment System 1.1.0 - Insecure Cookie Handling

CVE-2008-2293—webappsphp

admin.php in Multi-Page Comment System (MPCS) 1.0 and 1.1 allows remote attackers to bypass authentication and gain priv

23RISK

open ↗

Referência✓ VexDay Proof

AyeView 2.20 - Invalid Bitmap Header Parsing Crash

CVE-2008-5937—doswindows

AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a

23RISK

open ↗

Referência

CVE-2012-1047

CVE-2012-1047—

Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 a

23RISK

open ↗

Referência

CVE-2010-2330

CVE-2010-2330—

Stack-based buffer overflow in iSharer File Sharing Wizard 1.5.0 allows remote attackers to cause a denial of service (c

28RISK

open ↗

Referência

CVE-2013-6787

CVE-2013-6787—

SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlie

23RISK

open ↗

Referência

CVE-2010-2333

CVE-2010-2333—

LiteSpeed Technologies LiteSpeed Web Server 4.0.x before 4.0.15 allows remote attackers to read the source code of scrip

50RISK

open ↗

Referência

CVE-2018-0822

CVE-2018-0822—

NTFS in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an eleva

23RISK

open ↗

Referência

CVE-2018-16659

CVE-2018-16659—

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked q

23RISK

open ↗

Referência

CVE-2010-3489

CVE-2010-3489—

Cross-site scripting (XSS) vulnerability in netautor/napro4/home/login2.php in CMS Digital Workroom (formerly Netautor P

23RISK

open ↗

Referência

Jara 1.6 - SQL Injection

CVE-2011-4094—webappsphp

Jara 1.6 has a SQL injection vulnerability.

23RISK

open ↗

Referência

CVE-2018-7707

CVE-2018-7707—

Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitr

23RISK

open ↗

Referência

CVE-2004-1722

CVE-2004-1722—

SQL injection vulnerability in calendar.html in Merak Mail Server 5.2.7 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2009-3760

CVE-2009-3760—

Static code injection vulnerability in config/writeconfig.php in the sample code in the XenServer Resource Kit in Citrix

23RISK

open ↗

Referência✓ VexDay Proof

phpListPro 2.0.1 - 'Language' Remote Code Execution

CVE-2006-2523—webappsphp

PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, a

23RISK

open ↗

Referência✓ VexDay Proof

ACGVAnnu 1.3 - 'acgv.php?rubrik' Local File Inclusion

CVE-2007-2560—webappsphp

Directory traversal vulnerability in theme/acgv.php in ACGVannu 1.3 and earlier allows remote attackers to read arbitrar

23RISK

open ↗

Referência✓ VexDay Proof

Simple HTTPd 1.38 - Multiple Vulnerabilities

CVE-2007-6404—remotewindows

Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attac

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin WP-Cal 0.3 - 'editevent.php' SQL Injection

CVE-2008-0490—webappsphp

SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

Portail Web PHP 2.5.1.1 - Multiple Inclusion Vulnerabilities

CVE-2008-1068—webappsphp

Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 and earlier allow remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

WordPress Plugin Download - 'dl_id' SQL Injection

CVE-2008-1646—webappsphp

SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

HomePH Design 2.10 RC2 - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting

CVE-2008-2981—webappsphp

PHP remote file inclusion vulnerability in admin/templates/template_thumbnail.php in HomePH Design 2.10 RC2, when regist

23RISK

open ↗

Referência✓ VexDay Proof

Acc Autos 4.0 - Insecure Cookie Handling

CVE-2008-6292—webappsphp

Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) usernam

23RISK

open ↗

Referência✓ VexDay Proof

AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload

CVE-2008-7021—webappsphp

Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated use

23RISK

open ↗

Referência✓ VexDay Proof

Popcorn 1.87 - Remote Heap Overflow (PoC)

CVE-2009-1647—doswindows

Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a denial of serv

23RISK

open ↗

Referência

CVE-2010-1309

CVE-2010-1309—

Directory traversal vulnerability in Irmin CMS (formerly Pepsi CMS) 0.6 BETA2 allows remote attackers to read arbitrary

23RISK

open ↗

Referência

CVE-2017-1000366

CVE-2017-1000366—

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

23RISK

open ↗

Referência

CVE-2017-1000366

CVE-2017-1000366—

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causin

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.