Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,600cataloged exploits

39,734CVEs with public exploitation

24,695lab-tested

All Referência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecent popular risk

25,557 exploits

Referência

CVE-2019-9621

CVE-2019-9621HIGHunder attack

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b

100RISK

open ↗

Referência

CVE-2019-9621

CVE-2019-9621HIGHunder attack

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x b

100RISK

open ↗

Referência✓ VexDay Proof

DMXReady Secure Document Library 1.1 - SQL Injection

CVE-2009-0428—webappsphp

SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and ear

23RISK

open ↗

Referência✓ VexDay Proof

Sabros.us 1.75 - 'thumbnails.php' Remote File Disclosure

CVE-2008-1799—webappsphp

Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files vi

23RISK

open ↗

Referência

CVE-2009-4690

CVE-2009-4690—

Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to in

23RISK

open ↗

Referência✓ VexDay Proof

XOOPS Module GesGaleri - SQL Injection

CVE-2008-5321—webappsphp

SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2015-7808

CVE-2015-7808—

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PH

60RISK

open ↗

Referência

CVE-2016-0491

CVE-2016-0491—

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12

60RISK

open ↗

Referência

CVE-2018-0758

CVE-2018-0758—

Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitra

45RISK

open ↗

Referência✓ VexDay Proof

Extract Website - 'Filename' File Disclosure

CVE-2008-6334—webappsphp

Directory traversal vulnerability in download.php in eMetrix Extract Website allows remote attackers to read arbitrary f

23RISK

open ↗

Referência

CVE-2019-10669

CVE-2019-10669—

An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/dev

60RISK

open ↗

Referência✓ VexDay Proof

XOOPS myAds Module - 'lid' SQL Injection

CVE-2006-3341—webappsphp

SQL injection vulnerability in annonces-p-f.php in MyAds module 2.04jp for Xoops allows remote attackers to execute arbi

23RISK

open ↗

Referência

CVE-2021-20034

CVE-2021-20034—

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal

45RISK

open ↗

Referência

CVE-2009-4752

CVE-2009-4752—

PHP remote file inclusion vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2009-4753

CVE-2009-4753—

Multiple buffer overflows in the FTP server on the Addonics NAS Adapter NASU2FW41 with loader 1.17 allow remote attacker

23RISK

open ↗

Referência

CVE-2009-4756

CVE-2009-4756—

Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

VideoDB 2.2.1 - 'pdf.php' Remote File Inclusion

CVE-2006-5155—webappsphp

PHP remote file inclusion vulnerability in core/pdf.php in VideoDB 2.2.1 and earlier allows remote attackers to execute

23RISK

open ↗

Referência✓ VexDay Proof

724CMS 4.01 Enterprise - 'index.php' SQL Injection

CVE-2008-1858—webappsphp

SQL injection vulnerability in index.php in 724Networks 724CMS 4.01 and earlier allows remote attackers to execute arbit

23RISK

open ↗

Referência✓ VexDay Proof

iScripts Socialware - 'id' SQL Injection

CVE-2008-1859—webappsphp

SQL injection vulnerability in events.php in iScripts SocialWare allows remote attackers to execute arbitrary SQL comman

23RISK

open ↗

Referência✓ VexDay Proof

TxtBlog 1.0 Alpha - Local File Inclusion

CVE-2008-5639—webappsphp

Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via

23RISK

open ↗

Referência

CVE-2026-9481

CVE-2026-9481HIGH

Edimax EW-7438RPn formStats stack-based overflow

41RISK

open ↗

Referência

CVE-2018-12464

CVE-2018-12464CRITICAL

Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway

85RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component ongumatimesheet20 4b - Remote File Inclusion

CVE-2008-6347—webappsphp

PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b

35RISK

open ↗

Referência

CVE-2020-13160

CVE-2020-13160—

AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execut

60RISK

open ↗

Referência

CVE-2021-21425

CVE-2021-21425CRITICAL

Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

85RISK

open ↗

Referência

CVE-2017-0037

CVE-2017-0037HIGHunder attack

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilde

93RISK

open ↗

Referência✓ VexDay Proof

DevelopItEasy Photo Gallery 1.2 - SQL Injection

CVE-2008-6348—webappsphp

Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência

CVE-2009-2436

CVE-2009-2436—

SQL injection vulnerability in page.php in Online Dating Software MyPHPDating 1.0 allows remote attackers to execute arb

23RISK

open ↗

Referência

CVE-2017-12557

CVE-2017-12557—

A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and e

60RISK

open ↗

Referência

CVE-2020-13160

CVE-2020-13160—

AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execut

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.