Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

26,240 exploits

Referência

CVE-2013-5312

CVE-2013-5312—

Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbit

23RISK

open ↗

Referência✓ VexDay Proof

Expert Advisior - 'index.php?id' SQL Injection

CVE-2007-3882—webappsphp

SQL injection vulnerability in index.php in Expert Advisor allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection

CVE-2008-3407—webappsphp

phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a lo

23RISK

open ↗

Referência

CVE-2013-7368

CVE-2013-7368—

Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script

23RISK

open ↗

Referência

CVE-2018-13045

CVE-2018-13045—

SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to ex

23RISK

open ↗

Referência

CVE-2014-9331

CVE-2014-9331—

Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote

23RISK

open ↗

Referência

CVE-2018-13045

CVE-2018-13045—

SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to ex

23RISK

open ↗

Referência

CVE-2018-18804

CVE-2018-18804—

Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.

23RISK

open ↗

Referência

CVE-2019-11537

CVE-2019-11537—

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.ph

23RISK

open ↗

Referência✓ VexDay Proof

Fuju News 1.0 - Authentication Bypass / SQL Injection

CVE-2006-1838—webappsphp

edit_kategorie.php in Fuju News 1.0 allows remote attackers to bypass authentication by setting the authorized cookie.

23RISK

open ↗

Referência

CVE-2017-6552

CVE-2017-6552—

Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 devices have an insufficiently large default value for the maximum IPv6 routing

23RISK

open ↗

Referência✓ VexDay Proof

WFTPD Pro Server 3.23.1.1 - 'APPE' Remote Buffer Overflow (PoC)

CVE-2006-5826—doswindows

Buffer overflow in Texas Imperial Software WFTPD Pro Server 3.23.1.1 allows remote authenticated users to execute arbitr

28RISK

open ↗

Referência

CVE-2010-1714

CVE-2010-1714—

Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attacker

43RISK

open ↗

Referência✓ VexDay Proof

RealPlayer 10 - '.ra' Remote Denial of Service

CVE-2007-2497—doswindows

RealNetworks RealPlayer 10 Gold allows remote attackers to cause a denial of service (memory consumption) via a certain

23RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component mosDirectory 2.3.2 - 'catid' SQL Injection

CVE-2008-0690—webappsphp

SQL injection vulnerability in index.php in the mosDirectory (com_directory) 2.3.2 component for Joomla! allows remote a

23RISK

open ↗

Referência✓ VexDay Proof

GC Auction Platinum - 'cate_id' SQL Injection

CVE-2008-3413—webappsphp

SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitra

23RISK

open ↗

Referência✓ VexDay Proof

eNdonesia 8.4 (Calendar Module) - SQL Injection

CVE-2008-3452—webappsphp

SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

Ads Pro - 'dhtml.pl' Remote Command Execution

CVE-2008-6826—webappscgi

dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page par

23RISK

open ↗

Referência

CVE-2014-7289

CVE-2014-7289—

SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and

23RISK

open ↗

Referência

CVE-2016-8016

CVE-2016-8016—

Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote

23RISK

open ↗

Referência

CVE-2018-18324

CVE-2018-18324—

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter

23RISK

open ↗

Referência

CVE-2019-19363

CVE-2019-19363—

An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attacker

38RISK

open ↗

Referência

CVE-2010-4843

CVE-2010-4843—

SQL injection vulnerability in website-page.php in PHP Web Scripts Ad Manager Pro 3.0 allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2010-4853

CVE-2010-4853—

SQL injection vulnerability in the ccInvoices (com_ccinvoices) component for Joomla! allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2014-0683

CVE-2014-0683—

The web management interface on the Cisco RV110W firewall with firmware 1.2.0.9 and earlier, RV215W router with firmware

28RISK

open ↗

Referência

CVE-2021-24169

CVE-2021-24169—

Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS)

43RISK

open ↗

Referência✓ VexDay Proof

MySQL Commander 2.7 - 'home' Remote File Inclusion

CVE-2007-1439—webappsphp

PHP remote file inclusion vulnerability in ressourcen/dbopen.php in bitesser MySQL Commander 2.7 and earlier, when regis

23RISK

open ↗

Referência✓ VexDay Proof

Berylium2 2003-08-18 - 'beryliumroot' Remote File Inclusion

CVE-2007-2531—webappsphp

PHP remote file inclusion vulnerability in berylium-classes.php in Berylium2 2003-08-18 allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

RealVNC Windows Client 4.1.2 - Remote Denial of Service Crash (PoC)

CVE-2008-3493—doswindows

vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application cras

23RISK

open ↗

Referência✓ VexDay Proof

MyPHP CMS 0.3.1 - 'pid' SQL Injection

CVE-2008-3497—webappsphp

SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands vi

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.