Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,190 exploits

Referência

CVE-2009-3969

CVE-2009-3969—

Stack-based buffer overflow in Faslo Player 7.0 allows remote attackers to cause a denial of service (application crash)

23RISK

open ↗

Referência

CVE-2009-3970

CVE-2009-3970—

SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote auth

23RISK

open ↗

Referência

CVE-2020-36885

CVE-2020-36885CRITICAL

Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi

48RISK

open ↗

Referência

CVE-2023-54329

CVE-2023-54329CRITICAL

Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)

48RISK

open ↗

Referência✓ VexDay Proof

FLDS 1.2a - 'lpro.php' SQL Injection

CVE-2008-5779—webappsphp

SQL injection vulnerability in lpro.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2021-33351

CVE-2021-33351CRITICAL

Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allo

48RISK

open ↗

Referência✓ VexDay Proof

AskPert - Authentication Bypass

CVE-2008-6309—webappsphp

SQL injection vulnerability in index.php in W3matter AskPert allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência

CVE-2023-48901

CVE-2023-48901CRITICAL

A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute

48RISK

open ↗

Referência✓ VexDay Proof

Groone's GLink ORGanizer - 'index.php?cat' SQL Injection

CVE-2009-0299—webappsphp

SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2009-2306

CVE-2009-2306—

The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control,

23RISK

open ↗

Referência

CVE-2009-4196

CVE-2009-4196—

Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T run

23RISK

open ↗

Referência

CVE-2010-4782

CVE-2010-4782—

Multiple SQL injection vulnerabilities in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 allo

23RISK

open ↗

Referência

CVE-2014-5453

CVE-2014-5453—

Ubisoft Uplay PC before 4.6.1.3217 use weak permissions (Everyone: Full Control) for the program installation directory

23RISK

open ↗

Referência

CVE-2010-1078

CVE-2010-1078—

SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbit

23RISK

open ↗

Referência

CVE-2010-2921

CVE-2010-2921—

SQL injection vulnerability in the Golf Course Guide (com_golfcourseguide) component 0.9.6.0 beta and 1 beta for Joomla!

23RISK

open ↗

Referência

CVE-2012-1778

CVE-2012-1778—

SQL injection vulnerability in artykul_print.php in CreateVision CMS allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

CVE-2010-4996

CVE-2010-4996—

SQL injection vulnerability in ogp_show.php in esoftpro Online Guestbook Pro 5.1 allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2017-14311

CVE-2017-14311—

The Winring0x32.sys driver in NetMechanica NetDecision 5.8.2 allows local users to gain privileges via a crafted 0x9C402

23RISK

open ↗

Referência

CVE-2010-4144

CVE-2010-4144—

SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência

CVE-2011-5112

CVE-2011-5112—

SQL injection vulnerability in Alameda (com_alameda) component before 1.0.1 for Joomla! allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

Adobe Shockwave - 'ShockwaveVersion()' Stack Overflow (PoC)

CVE-2007-5941—doswindows

Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a den

35RISK

open ↗

Referência✓ VexDay Proof

X.Org xorg-server 1.1.1-48.13 - Probe for Files (PoC)

CVE-2007-5958—dosmultiple

X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary files via a filename argument in t

23RISK

open ↗

Referência

CVE-2024-6459

CVE-2024-6459CRITICAL

News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI

48RISK

open ↗

Referência

CVE-2008-3725

CVE-2008-3725—

SQL injection vulnerability in trr.php in YourFreeWorld Ad Board Script allows remote attackers to execute arbitrary SQL

23RISK

open ↗

Referência✓ VexDay Proof

Advanced Image Hosting (AIH) 2.3 - 'gal' Blind SQL Injection

CVE-2009-1032—webappsphp

SQL injection vulnerability in gallery_list.php in YABSoft Advanced Image Hosting (AIH) Script 2.3 allows remote attacke

23RISK

open ↗

Referência

CVE-2009-2341

CVE-2009-2341—

SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

Referência

CVE-2009-3357

CVE-2009-3357—

Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for

23RISK

open ↗

Referência

CVE-2009-4428

CVE-2009-4428—

SQL injection vulnerability in the JoomPortfolio (com_joomportfolio) component 1.0.0 for Joomla! allows remote attackers

23RISK

open ↗

Referência

CVE-2010-2923

CVE-2010-2923—

SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2010-2923

CVE-2010-2923—

SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute ar

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.