Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,313cataloged exploits

34,834CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,797GitHub PoC 13,885VulnCheck XDB 8,484Nuclei 4,237Metasploit 3,467✓ verified onlyrecent popular risk

21,797 exploits

Referência

CVE-2017-9429

CVE-2017-9429—

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

MolyX BOARD 2.5.0 - 'index.php?lang' Local File Inclusion

CVE-2007-2778—webappsphp

Multiple directory traversal vulnerabilities in MolyX BOARD 2.5.0 allow remote attackers to read arbitrary files via a .

23RISK

open ↗

Referência

CVE-2015-4064

CVE-2015-4064—

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo

23RISK

open ↗

Referência

CVE-2015-4064

CVE-2015-4064—

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allo

23RISK

open ↗

Referência✓ VexDay Proof

EnjoySAP ActiveX kweditcontrol.kwedit.1 - Remote Stack Overflow (PoC)

CVE-2007-3607—doswindows

Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denia

23RISK

open ↗

Referência

CVE-2015-4018

CVE-2015-4018—

SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for W

23RISK

open ↗

Referência

CVE-2015-4018

CVE-2015-4018—

SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for W

23RISK

open ↗

Referência

CVE-2017-11494

CVE-2017-11494—

SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

OSSIM 0.9.9rc5 - Cross-Site Scripting / SQL Injection

CVE-2008-0919—webappsphp

Cross-site scripting (XSS) vulnerability in session/login.php in Open Source Security Information Management (OSSIM) 0.9

23RISK

open ↗

Referência✓ VexDay Proof

e107 Plugin BLOG Engine 2.2 - 'rid' Blind SQL Injection

CVE-2008-2455—webappsphp

SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to exe

23RISK

open ↗

Referência✓ VexDay Proof

ComicShout 2.5 - 'comic_id' SQL Injection

CVE-2008-2456—webappsphp

SQL injection vulnerability in index.php in ComicShout 2.5 and earlier allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência

CVE-2023-0224

CVE-2023-0224CRITICAL

GiveWP < 2.24.1 - Unauthenticated SQLi

48RISK

open ↗

Referência

CVE-2014-10031

CVE-2014-10031—

Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2011-4713

CVE-2011-4713—

Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arb

23RISK

open ↗

Referência

CVE-2017-14960

CVE-2017-14960—

xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL I

23RISK

open ↗

Referência✓ VexDay Proof

Siemens C450IP/C475IP - Remote Denial of Service

CVE-2008-7065—doshardware

Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and dev

23RISK

open ↗

Referência

CVE-2010-1299

CVE-2010-1299—

Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is di

28RISK

open ↗

Referência✓ VexDay Proof

MyBulletinBoard (MyBB) 1.03 - 'misc.php' SQL Injection

CVE-2006-0959—webappsphp

SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote

23RISK

open ↗

Referência

CVE-2009-4578

CVE-2009-4578—

Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows rem

23RISK

open ↗

Referência✓ VexDay Proof

acFTP FTP Server 1.4 - 'USER' Remote Buffer Overflow (PoC)

CVE-2006-2242—doswindows

acFTP 1.4 allows remote attackers to cause a denial of service (application crash) via a long string with "{" (brace) ch

23RISK

open ↗

Referência

CVE-2014-3738

CVE-2014-3738—

Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML

23RISK

open ↗

Referência

CVE-2014-9610

CVE-2014-9610—

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication an

23RISK

open ↗

Referência

CVE-2014-9610

CVE-2014-9610—

Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication an

23RISK

open ↗

Referência✓ VexDay Proof

SimpCMS 04.10.2007 - 'site' Remote File Inclusion

CVE-2007-2009—webappsphp

PHP remote file inclusion vulnerability in index.php in SimpCMS Light 04.10.2007 and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

maGAZIn 2.0 - 'PHPThumb.php?src' Remote File Disclosure

CVE-2007-2643—webappsphp

Directory traversal vulnerability in phpThumb.php in PinkCrow Designs Gallery or maGAZIn 2.0 allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

SunLight CMS 5.3 - 'root' Remote File Inclusion

CVE-2007-2774—webappsphp

Multiple PHP remote file inclusion vulnerabilities in SunLight CMS 5.3 allow remote attackers to execute arbitrary PHP c

23RISK

open ↗

Referência✓ VexDay Proof

Bitweaver R2 CMS - Arbitrary File Upload / Disclosure

CVE-2007-6651—webappsphp

Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive infor

23RISK

open ↗

Referência✓ VexDay Proof

ItCMS 1.9 - 'boxpop.php' Remote Code Execution

CVE-2008-2192—webappsphp

Static code injection vulnerability in box/minichat/boxpop.php in IT!CMS (aka itcms) 1.9 allows remote attackers to inje

23RISK

open ↗

Referência✓ VexDay Proof

PHP Jokesite 2.0 - 'cat_id' SQL Injection

CVE-2008-2457—webappsphp

SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Samsung DVR SHR2040 - HTTPd Remote Denial of Service Denial of Service (PoC)

CVE-2008-4380—doshardware

The web interface in Samsung DVR SHR2040 allows remote attackers to cause a denial of service (crash) via a malformed HT

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.