Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,679cataloged exploits

40,329CVEs with public exploitation

24,696lab-tested

All Referência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

26,150 exploits

Referência

CVE-2018-7701

CVE-2018-7701—

Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers

23RISK

open ↗

Referência

CVE-2018-8411

CVE-2018-8411—

An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vuln

23RISK

open ↗

Referência

CVE-2016-5740

CVE-2016-5740—

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical atta

23RISK

open ↗

Referência

CVE-2017-17110

CVE-2017-17110—

Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

23RISK

open ↗

Referência

CVE-2017-6367

CVE-2017-6367—

In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack methodology invo

23RISK

open ↗

Referência

CVE-2012-2277

CVE-2012-2277—

The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote

23RISK

open ↗

Referência

CVE-2012-5876

CVE-2012-5876—

Multiple off-by-one errors in NMMediaServerService.dll in Nero MediaHome 4.5.8.0 and earlier allow remote attackers to c

23RISK

open ↗

Referência✓ VexDay Proof

Flat Chat 2.0 - 'include online.txt' Remote Code Execution

CVE-2007-1394—webappsphp

Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

CenterIM 4.22.3 - Remote Command Execution

CVE-2008-1467—remotelinux

CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters

23RISK

open ↗

Referência

CVE-2010-1876

CVE-2010-1876—

SQL injection vulnerability in index.php in AJ Shopping Cart 1.0 allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

Technote 7 - 'shop_this_skin_path' Remote File Inclusion

CVE-2008-4138—webappsphp

PHP remote file inclusion vulnerability in skin_shop/standard/3_plugin_twindow/twindow_notice.php in TECHNOTE 7 allows r

28RISK

open ↗

Referência

CVE-2011-1591

CVE-2011-1591—

Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allow

50RISK

open ↗

Referência

CVE-2008-4378

CVE-2008-4378—

SQL injection vulnerability in report.php in Mr. CGI Guy Hot Links SQL-PHP 3.0 and earlier allows remote attackers to ex

23RISK

open ↗

Referência

CVE-2013-4730

CVE-2013-4730—

Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USE

50RISK

open ↗

Referência

Core FTP 2.0 - 'XRMD' Denial of Service (PoC)

CVE-2018-20658—doswindows

The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon cr

23RISK

open ↗

Referência

CVE-2012-5858

CVE-2012-5858—

Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-m

23RISK

open ↗

Referência

CVE-2021-37531

CVE-2021-37531CRITICAL

SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerabili

48RISK

open ↗

Referência✓ VexDay Proof

mxBB Module calsnails 1.06 - 'mx_common.php' File Inclusion

CVE-2006-6065—webappsphp

PHP remote file inclusion vulnerability in includes/mx_common.php in the CalSnails Module for MxBB Portal 1.06 allows re

23RISK

open ↗

Referência

CVE-2019-10848

CVE-2019-10848—

Computrols CBAS 18.0.0 allows Username Enumeration.

23RISK

open ↗

Referência

CVE-2013-5756

CVE-2013-5756—

Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary fil

23RISK

open ↗

Referência

CVE-2015-1482

CVE-2015-1482—

Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform

23RISK

open ↗

Referência

CVE-2009-4264

CVE-2009-4264—

PHP remote file inclusion vulnerability in components/core/connect.php in AROUNDMe 1.1 and earlier, when register_global

23RISK

open ↗

Referência

CVE-2015-7293

CVE-2015-7293—

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone bef

23RISK

open ↗

Referência

CVE-2013-4861

CVE-2013-4861—

Directory traversal vulnerability in cgi-bin/cmh/get_file.sh in MiCasaVerde VeraLite with firmware 1.5.408 allows remote

23RISK

open ↗

Referência

CVE-2017-11330

CVE-2017-11330—

The DivFixppCore::avi_header_fix function in DivFix++Core.cpp in DivFix++ v0.34 allows remote attackers to cause a denia

23RISK

open ↗

Referência

CVE-2010-3213

CVE-2010-3213—

Cross-site request forgery (CSRF) vulnerability in Microsoft Outlook Web Access (owa/ev.owa) 2007 through SP2 allows rem

23RISK

open ↗

Referência✓ VexDay Proof

Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution

CVE-2007-3139—webappsphp

config/general.php in Quick.Cart 2.2 and earlier uses a default username and password, which allows remote attackers to

23RISK

open ↗

Referência

CVE-2007-5982

CVE-2007-5982—

Multiple cross-site scripting (XSS) vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote at

23RISK

open ↗

Referência

CVE-2008-4157

CVE-2008-4157—

SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Zanfi CMS lite / Jaw Portal free - 'page' SQL Injection

CVE-2008-4159—webappsphp

SQL injection vulnerability in index.php in Jaw Portal and Zanfi CMS lite and allows remote attackers to execute arbitra

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.