Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2017-0175

CVE-2017-0175—

The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sen

23RISK

open ↗

Referência

CVE-2017-2365

CVE-2017-2365—

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS

23RISK

open ↗

Referência

CVE-2017-7018

CVE-2017-7018—

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iClo

23RISK

open ↗

Referência

CVE-2019-16679

CVE-2019-16679—

Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.

23RISK

open ↗

Referência✓ VexDay Proof

RGameScript Pro - 'page.php?id' Remote File Inclusion

CVE-2007-3980—webappsphp

PHP remote file inclusion vulnerability in page.php in RCMS Pro RGameScript Pro allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

EasyMail MessagePrinter Object - 'emprint.dll 6.0.1.0' Remote Buffer Overflow

CVE-2007-5070—remotewindows

Heap-based buffer overflow in the EasyMailMessagePrinter ActiveX control in emprint.DLL 6.0.1.0 in the Quiksoft EasyMail

23RISK

open ↗

Referência

CVE-2010-2682

CVE-2010-2682—

Directory traversal vulnerability in the Realtyna Translator (com_realtyna) component 1.0.15 for Joomla! allows remote a

43RISK

open ↗

Referência

CVE-2010-4935

CVE-2010-4935—

SQL injection vulnerability in poll.php in Entrans 0.3.2 and earlier allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

CVE-2010-0672

CVE-2010-0672—

SQL injection vulnerability in index.php in WSN Guest 1.02 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2010-4940

CVE-2010-4940—

SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

BS.Player 2.27 Build 959 - '.srt' File Buffer Overflow (PoC)

CVE-2008-6583—doswindows

Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of service (crash) and possibly ex

23RISK

open ↗

Referência✓ VexDay Proof

Pi3Web 2.0.3 - 'ISAPI' Remote Denial of Service

CVE-2008-6938—doswindows

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi

43RISK

open ↗

Referência

CVE-2009-3365

CVE-2009-3365—

PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 all

23RISK

open ↗

Referência

CVE-2021-22146

CVE-2021-22146—

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.

35RISK

open ↗

Referência

CVE-2017-15270

CVE-2017-15270—

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) f

23RISK

open ↗

Referência

CVE-2017-2932

CVE-2017-2932—

Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript

28RISK

open ↗

Referência

CVE-2019-1914

CVE-2019-1914HIGH

Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability

46RISK

open ↗

Referência

CVE-2013-4859

CVE-2013-4859—

INSTEON Hub 2242-222 lacks Web and API authentication

23RISK

open ↗

Referência

CVE-2014-3008

CVE-2014-3008—

Unitrends Enterprise Backup 7.3.0 allows remote authenticated users to execute arbitrary commands via shell metacharacte

23RISK

open ↗

Referência

CVE-2017-2363

CVE-2017-2363—

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS

23RISK

open ↗

Referência✓ VexDay Proof

JAF CMS 4.0 RC2 - Multiple Remote File Inclusions

CVE-2008-1609—webappsphp

Multiple PHP remote file inclusion vulnerabilities in just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to

35RISK

open ↗

Referência

CVE-2015-2511

CVE-2015-2511—

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Win

23RISK

open ↗

Referência

CVE-2015-6763

CVE-2015-6763—

Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a denial of service o

23RISK

open ↗

Referência

CVE-2015-6763

CVE-2015-6763—

Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a denial of service o

23RISK

open ↗

Referência

CVE-2015-8358

CVE-2015-8358—

Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators t

23RISK

open ↗

Referência

CVE-2015-8358

CVE-2015-8358—

Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators t

23RISK

open ↗

Referência

CVE-2010-4968

CVE-2010-4968—

SQL injection vulnerability in the webmaster-tips.net Flash Gallery (com_wmtpic) component 1.0 for Joomla! allows remote

23RISK

open ↗

Referência

CVE-2010-0677

CVE-2010-0677—

SQL injection vulnerability in index.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, allows remote attackers

23RISK

open ↗

Referência

CVE-2017-15270

CVE-2017-15270—

The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) f

23RISK

open ↗

Referência

CVE-2009-4553

CVE-2009-4553—

Stack-based buffer overflow in iRehearse allows remote attackers to cause a denial of service (application crash) or pos

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.