Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
22,266 exploits
Referência
CVE-2015-7602
CVE-2015-7602—
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (d
50RISK
open ↗
Referência
CVE-2015-7602
CVE-2015-7602—
Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (d
50RISK
open ↗
Referência
CVE-2014-2849
CVE-2014-2849—
The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users
50RISK
open ↗
Referência
CVE-2014-3913
CVE-2014-3913—
Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrar
50RISK
open ↗
Referência
CVE-2014-3913
CVE-2014-3913—
Stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrar
50RISK
open ↗
Referência✓ VexDay Proof
Prozilla Webring Website Script - 'category.php?cat' SQL Injection
CVE-2007-4362—webappsphp
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL command
23RISK
open ↗
Referência✓ VexDay Proof
IBM Rational ClearQuest - Web Authentication Bypass / SQL Injection
CVE-2007-4368—webappscgi
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attack
23RISK
open ↗
Referência
CVE-2009-3224
CVE-2009-3224—
SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remo
23RISK
open ↗
Referência
CVE-2023-27179
CVE-2023-27179HIGH
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename paramet
68RISK
open ↗
Referência
CVE-2023-27179
CVE-2023-27179HIGH
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename paramet
68RISK
open ↗
Referência
CVE-2018-18982
CVE-2018-18982—
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
50RISK
open ↗
Referência
CVE-2013-4074
CVE-2013-4074—
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
50RISK
open ↗
Referência
CVE-2019-17662
CVE-2019-17662—
ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exi
60RISK
open ↗
Referência
CVE-2020-3250
CVE-2020-3250CRITICAL
Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data
75RISK
open ↗
Referência
CVE-2011-0257
CVE-2011-0257—
Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a deni
50RISK
open ↗
Referência
CVE-2014-10021
CVE-2014-10021—
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote
50RISK
open ↗
Referência
CVE-2019-5485
CVE-2019-5485—
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be inje
35RISK
open ↗
Referência
CVE-2017-11841
CVE-2017-11841—
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, versio
35RISK
open ↗
Referência
CVE-2017-11870
CVE-2017-11870—
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the
35RISK
open ↗
Referência
CVE-2016-3074
CVE-2016-3074—
Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of
35RISK
open ↗
Referência✓ VexDay Proof
Elkagroup Image Gallery 1.0 - Arbitrary File Upload
CVE-2009-1446—webappsphp
Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users to
23RISK
open ↗
Referência
CVE-2018-7314
CVE-2018-7314—
SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerabil
50RISK
open ↗
Referência
CVE-2009-3246
CVE-2009-3246—
SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência
CVE-2022-47075
CVE-2022-47075HIGH
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the
68RISK
open ↗
Referência
CVE-2017-16249
CVE-2017-16249—
The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST requ
50RISK
open ↗
Referência
CVE-2017-16249
CVE-2017-16249—
The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST requ
50RISK
open ↗
Referência
CVE-2015-1172
CVE-2015-1172—
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 a
50RISK
open ↗
Referência✓ VexDay Proof
Dayfox Blog 4 - 'postpost.php' Remote Code Execution
CVE-2007-1525—webappsphp
Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute
35RISK
open ↗
Referência
CVE-2018-0707
CVE-2018-0707—
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RISK
open ↗
Referência
CVE-2018-0707
CVE-2018-0707—
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RISK
open ↗
← previouspage 412 / 743next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.