Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
21,692 exploits
Referência
CVE-2018-18794
CVE-2018-18794—
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISK
open ↗
Referência
CVE-2018-12739
CVE-2018-12739—
In BEESCMS 4.0, CSRF allows administrators to be added arbitrarily, a related issue to CVE-2018-10266.
23RISK
open ↗
Referência✓ VexDay Proof
Smeego 1.0 - 'Cookie lang' Local File Inclusion
CVE-2008-2352—webappsphp
Directory traversal vulnerability in index.php in Smeego 1.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗
Referência
CVE-2012-4262
CVE-2012-4262—
Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2012-4262
CVE-2012-4262—
Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or
23RISK
open ↗
Referência
CVE-2018-6023
CVE-2018-6023—
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act
23RISK
open ↗
Referência
CVE-2018-6023
CVE-2018-6023—
Fastweb FASTgate 0.00.47 devices are vulnerable to CSRF, with impacts including Wi-Fi password changing, Guest Wi-Fi act
23RISK
open ↗
Referência✓ VexDay Proof
Pixie CMS - Cross-Site Scripting / SQL Injection
CVE-2009-1066—webappsphp
SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attacker
23RISK
open ↗
Referência
CVE-2018-18797
CVE-2018-18797—
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗
Referência
CVE-2012-5899
CVE-2012-5899—
Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers t
23RISK
open ↗
Referência
CVE-2012-3837
CVE-2012-3837—
Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earl
23RISK
open ↗
Referência
CVE-2012-5350
CVE-2012-5350—
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with
23RISK
open ↗
Referência
CVE-2010-4851
CVE-2010-4851—
Multiple SQL injection vulnerabilities in Eclime 1.1.2b allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2010-4851
CVE-2010-4851—
Multiple SQL injection vulnerabilities in Eclime 1.1.2b allow remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência
CVE-2010-1497
CVE-2010-1497—
Cross-site scripting (XSS) vulnerability in download_proc.php in dl_stats before 2.0 allows remote attackers to inject a
23RISK
open ↗
Referência
CVE-2010-1497
CVE-2010-1497—
Cross-site scripting (XSS) vulnerability in download_proc.php in dl_stats before 2.0 allows remote attackers to inject a
23RISK
open ↗
Referência✓ VexDay Proof
Enterprise Payroll Systems 1.1 - 'footer' Remote File Inclusion
CVE-2006-2982—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Enterprise Timesheet and Payroll Systems (EPS) 1.1 and earlier all
23RISK
open ↗
Referência
CVE-2019-10261
CVE-2019-10261—
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fiel
23RISK
open ↗
Referência
CVE-2016-8806
CVE-2016-8806—
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3
23RISK
open ↗
Referência
CVE-2010-1858
CVE-2010-1858—
Directory traversal vulnerability in the SMEStorage (com_smestorage) component before 1.1 for Joomla! allows remote atta
43RISK
open ↗
Referência✓ VexDay Proof
Contenido 4.8.4 - Remote File Inclusion / Cross-Site Scripting
CVE-2008-2912—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PH
23RISK
open ↗
Referência✓ VexDay Proof
PHP Multiple Newsletters 2.7 - Local File Inclusion / Cross-Site Scripting
CVE-2008-5570—webappsphp
Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic_quotes_gpc is disabled, allow
23RISK
open ↗
Referência✓ VexDay Proof
My Simple Forum 3.0 - Local File Inclusion
CVE-2008-5604—webappsphp
Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência
CVE-2008-5072
CVE-2008-5072—
vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash)
23RISK
open ↗
Referência
CVE-2018-7465
CVE-2018-7465—
An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by
23RISK
open ↗
Referência
CVE-2009-4465
CVE-2009-4465—
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗
Referência
CVE-2017-9650
CVE-2017-9650—
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL
23RISK
open ↗
Referência
CVE-2013-5640
CVE-2013-5640—
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência
CVE-2013-5640
CVE-2013-5640—
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗
Referência
CVE-2010-3480
CVE-2010-3480—
Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows re
23RISK
open ↗
← previouspage 278 / 724next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.