Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits

34,679CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecent popular risk

21,662 exploits

Referência

CVE-2012-4282

CVE-2012-4282—

SQL injection vulnerability in photo.php in Trombinoscope 3.5 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2011-5229

CVE-2011-5229—

SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attac

23RISK

open ↗

Referência

CVE-2012-1673

CVE-2012-1673—

SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2012-1672

CVE-2012-1672—

SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2013-3537

CVE-2013-3537—

Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2013-3531

CVE-2013-3531—

SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2012-1018

CVE-2012-1018—

Cross-site scripting (XSS) vulnerability in includes/convert.php in D-Mack Media Currency Converter (mod_currencyconvert

23RISK

open ↗

Referência

CVE-2016-8811

CVE-2016-8811—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência

CVE-2016-8808

CVE-2016-8808—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência✓ VexDay Proof

Seditio CMS 121 - SQL Injection

CVE-2007-6202—webappsphp

SQL injection vulnerability in plugins/search/search.php in Neocrome Seditio CMS 121 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

cf shopkart 5.2.2 - SQL Injection / File Disclosure

CVE-2008-6321—webappsasp

CF Shopkart 5.2.2 stores cfshopkart52.mdb under the web root with insufficient access control, which allows remote attac

23RISK

open ↗

Referência

CVE-2024-53537

CVE-2024-53537CRITICAL

An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager

48RISK

open ↗

Referência

CVE-2007-6135

CVE-2007-6135—

Cross-site scripting (XSS) vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remot

23RISK

open ↗

Referência

CVE-2014-8995

CVE-2014-8995—

SQL injection vulnerability in Maarch LetterBox 2.8 allows remote attackers to execute arbitrary SQL commands via the Us

23RISK

open ↗

Referência

CVE-2017-12970

CVE-2017-12970—

Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authenticati

23RISK

open ↗

Referência

CVE-2017-12970

CVE-2017-12970—

Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authenticati

23RISK

open ↗

Referência

CVE-2009-4961

CVE-2009-4961—

Lanai Core 0.6 allows remote attackers to obtain configuration information via a direct request to info.php, which calls

23RISK

open ↗

Referência

CVE-2009-2329

CVE-2009-2329—

KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) admin

23RISK

open ↗

Referência

CVE-2017-16513

CVE-2017-16513—

Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations fie

23RISK

open ↗

Referência

SPBAS Business Automation Software 2012 - Multiple Vulnerabilities

CVE-2013-4664—webappsphp

SPBAS Business Automation Software 2012 has XSS.

23RISK

open ↗

Referência✓ VexDay Proof

ZoomStats 1.0.2 - 'mysql.php' Remote File Inclusion

CVE-2006-5065—webappsphp

PHP remote file inclusion vulnerability in libs/dbmax/mysql.php in ZoomStats 1.0.2 and earlier, when register_globals is

23RISK

open ↗

Referência

CVE-2017-16570

CVE-2017-16570—

KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureL

23RISK

open ↗

Referência

CVE-2008-0233

CVE-2008-0233—

Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended acce

23RISK

open ↗

Referência

CVE-2010-5053

CVE-2010-5053—

SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2010-5053

CVE-2010-5053—

SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2016-8809

CVE-2016-8809—

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

23RISK

open ↗

Referência✓ VexDay Proof

PhShoutBox 1.5 - Insecure Cookie Handling

CVE-2008-1971—webappsphp

phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain p

23RISK

open ↗

Referência

CVE-2009-2588

CVE-2009-2588—

Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject

23RISK

open ↗

Referência

CVE-2018-1202

CVE-2018-1202—

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is af

23RISK

open ↗

Referência

CVE-2010-3131

CVE-2010-3131—

Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 an

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.