Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Belkin Wemo - Arbitrary Firmware Upload
CVE-2013-2748—webappshardware08 Apr 2013
Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.
28RISK
open ↗
Exploit-DB
Vanilla Forums 2-0-18-4 - SQL Injection
CVE-2013-3527—webappsphp08 Apr 2013
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Exploit-DB
Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities
CVE-2013-2643—webappslinux08 Apr 2013
Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inj
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Novell ZENworks Configuration Management 10 SP3/11 SP2 - Remote Execution (Metasploit)
CVE-2013-1080—remotemultiple08 Apr 2013
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform a
60RISK
open ↗
Exploit-DB
Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities
CVE-2013-2642—webappslinux08 Apr 2013
Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters i
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Groovy Media Player 3.2.0 - '.mp3' Buffer Overflow
CVE-2013-2760—doswindows08 Apr 2013
Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MongoDB 2.2.3 - nativeHelper.apply Remote Code Execution
CVE-2013-1892—remotelinux08 Apr 2013
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
50RISK
open ↗
Exploit-DB
WHMCompleteSolution (WHMCS) Group Pay Plugin 1.5 - 'grouppay.php?hash' SQL Injection
CVE-2013-3536—webappsphp08 Apr 2013
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and ea
23RISK
open ↗
Exploit-DB
Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities
CVE-2013-2641—webappslinux08 Apr 2013
Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read
60RISK
open ↗
Exploit-DB✓ VexDay Proof
OTRS 3.x - FAQ Module Persistent Cross-Site Scripting
CVE-2013-2637—webappsmultiple08 Apr 2013
A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/edit_user.php?id' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/reset_password.php' Multiple SQL Injections
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Subversion 1.6.x - 'mod_dav_svn/lock.c' Remote Denial of Service
CVE-2013-1847—doslinux05 Apr 2013
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote atta
35RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/delete_user.php?id' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/linktick.php?site' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/admin_index.php?q' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Zimbra - 'aspell.php' Cross-Site Scripting
CVE-2013-1938—webappsphp05 Apr 2013
Zimbra 2013 has XSS in aspell.php
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/router.php?BasicLogin' Cookie SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/checklogin.php?Username' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/user_add_save.php?email' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/edit_user_save.php' Multiple SQL Injections
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/traffic.php?var' SQL Injection
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Subversion - Remote Denial of Service
CVE-2013-1884—doslinux05 Apr 2013
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial o
35RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP Address Book - '/addressbook/register/reset_password_save.php' Multiple SQL Injections
CVE-2013-0135—webappsphp05 Apr 2013
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL command
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Google Chrome - Cookie Verification Denial of Service
CVE-2013-6166—dosmultiple04 Apr 2013
Google Chrome before 29 sends HTTP Cookie headers without first validating that they have the required character-set res
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox - Cookie Verification Denial of Service
CVE-2013-6167—dosmultiple04 Apr 2013
Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required character-set
23RISK
open ↗
Exploit-DB
Google Chrome 26.0.1410.43 (Webkit) - OBJECT Element Use-After-Free (PoC)
CVE-2013-2842—dososx04 Apr 2013
Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service o
28RISK
open ↗
Exploit-DB✓ VexDay Proof
e107 - 'content_preset.php' Cross-Site Scripting
CVE-2013-2750—webappsphp03 Apr 2013
Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Symphony - 'sort' SQL Injection
CVE-2013-2559—webappsphp03 Apr 2013
SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL comm
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FUDforum - Multiple Remote PHP Code Injection Vulnerabilities
CVE-2013-2267—webappsphp03 Apr 2013
PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbit
23RISK
open ↗
← previouspage 262 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.