Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
CVE-2012-1258—webappsmultiple19 Apr 2012
cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Wireshark - 'call_dissector()' Null Pointer Dereference Denial of Service
CVE-2012-1593—dosmultiple19 Apr 2012
epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows r
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Samsung D6000 TV - Multiple Vulnerabilities
CVE-2012-4329—doshardware19 Apr 2012
The Samsung D6000 TV and possibly other products allow remote attackers to cause a denial of service (continuous restart
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
CVE-2012-1260—webappsmultiple19 Apr 2012
Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow An
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
CVE-2012-1259—webappsmultiple19 Apr 2012
Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and pos
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Samsung D6000 TV - Multiple Vulnerabilities
CVE-2012-4330—doshardware19 Apr 2012
The Samsung D6000 TV and possibly other products allows remote attackers to cause a denial of service (crash) via a long
28RISK
open ↗
Exploit-DB✓ VexDay Proof
newscoop 3.5.3 - Multiple Vulnerabilities
CVE-2012-1934—webappsphp19 Apr 2012
SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attack
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities
CVE-2012-1261—webappsmultiple19 Apr 2012
Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow
23RISK
open ↗
Exploit-DB✓ VexDay Proof
OpenSSL - ASN1 BIO Memory Corruption
CVE-2012-2131—dosmultiple19 Apr 2012
Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer
28RISK
open ↗
Exploit-DB✓ VexDay Proof
newscoop 3.5.3 - Multiple Vulnerabilities
CVE-2012-4679—webappsphp19 Apr 2012
Cross-site scripting (XSS) vulnerability in admin/login.php in Newscoop before 3.5.5 allows remote attackers to inject a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
newscoop 3.5.3 - Multiple Vulnerabilities
CVE-2012-1933—webappsphp19 Apr 2012
Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_global
23RISK
open ↗
Exploit-DB✓ VexDay Proof
XOOPS 2.5.4 - '/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2012-0984—webappsphp18 Apr 2012
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CyberLink Power2Go - name Attribute (p2g) Stack Buffer Overflow (Metasploit)
CVE-2011-5171—localwindows18 Apr 2012
Multiple stack-based buffer overflows in CyberLink Power2Go 7 (build 196) and 8 (build 1031) allow remote attackers to e
50RISK
open ↗
Exploit-DB✓ VexDay Proof
ownCloud 3.0.0 - 'index.php?redirect_url' Arbitrary Site Redirect
CVE-2012-2270—webappsphp18 Apr 2012
Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redire
23RISK
open ↗
Exploit-DB✓ VexDay Proof
XOOPS 2.5.4 - '/modules/pm/pmlite.php?to_userid' Cross-Site Scripting
CVE-2012-0984—webappsphp18 Apr 2012
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Acuity CMS 2.6.2 - 'Username' Cross-Site Scripting
CVE-2012-4745—webappsphp17 Apr 2012
Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TeamPass 2.1.5 - 'login' HTML Injection
CVE-2012-2234—webappsphp17 Apr 2012
Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticat
23RISK
open ↗
Exploit-DB✓ VexDay Proof
V-CMS - Arbitrary '.PHP' File Upload / Execution (Metasploit)
CVE-2011-4828—remotephp14 Apr 2012
Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote atta
50RISK
open ↗
Exploit-DB✓ VexDay Proof
IrfanView FlashPix PlugIn - Decompression Heap Overflow
CVE-2012-0278—doswindows14 Apr 2012
Heap-based buffer overflow in the FlashPix PlugIn before 4.3.4.0 for IrfanView might allow remote attackers to execute a
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Munin 2.0~rc4-1 - Remote Command Injection
CVE-2012-2104—webappscgi13 Apr 2012
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Quest InTrust - Annotation Objects Uninitialized Pointer (Metasploit)
CVE-2012-5896—remotewindows13 Apr 2012
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not prope
50RISK
open ↗
Exploit-DB
Invision Power Board 3.3.0 - Local File Inclusion
CVE-2012-2226—webappsphp13 Apr 2012
Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sen
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WICD 1.7.1 - Local Privilege Escalation
CVE-2012-2095—locallinux12 Apr 2012
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configur
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EMC IRM License Server 4.6.1.1995 - Denial of Service
CVE-2012-2276—doshardware12 Apr 2012
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
EMC IRM License Server 4.6.1.1995 - Denial of Service
CVE-2012-2277—doshardware12 Apr 2012
The IRM Server in EMC Documentum Information Rights Management 4.x before 4.7.0100 and 5.x before 5.0.1030 allows remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin All-in-One Event Calendar 1.4 - 'agenda-widget-form.php?title' Cross-Site Scripting
CVE-2012-1835—webappsphp11 Apr 2012
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress al
38RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin All-in-One Event Calendar 1.4 - 'box_publish_button.php?button_value' Cross-Site Scripting
CVE-2012-1835—webappsphp11 Apr 2012
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress al
38RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin All-in-One Event Calendar 1.4 - 'agenda-widget.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2012-1835—webappsphp11 Apr 2012
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress al
38RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin All-in-One Event Calendar 1.4 - 'save_successful.php?msg' Cross-Site Scripting
CVE-2012-1835—webappsphp11 Apr 2012
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress al
38RISK
open ↗
Exploit-DB✓ VexDay Proof
Joomla! Component Estate Agent - SQL Injection
CVE-2011-4571—webappsphp10 Apr 2012
SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execu
23RISK
open ↗
← previouspage 290 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.