Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits

35,469CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecent popular risk

22,266 exploits

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISK

open ↗

Referência

CVE-2010-0674

CVE-2010-0674—

StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote at

23RISK

open ↗

Referência

CVE-2012-6048

CVE-2012-6048—

Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.

23RISK

open ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência

CVE-2010-0939

CVE-2010-0939—

Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows re

23RISK

open ↗

Referência

CVE-2010-0765

CVE-2010-0765—

fipsForum 2.6 stores sensitive information under the web root with insufficient access control, which allows remote atta

23RISK

open ↗

Referência

CVE-2004-1580

CVE-2004-1580—

SQL injection vulnerability in index.php in CubeCart 2.0.1 allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência✓ VexDay Proof

vhostadmin 0.1 - 'MODULES_DIR' Remote File Inclusion

CVE-2007-0558—webappsphp

PHP remote file inclusion vulnerability in modules/mail/main.php in Inter7 vHostAdmin 1.0 allows remote attackers to exe

23RISK

open ↗

Referência

CVE-2018-11532

CVE-2018-11532—

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonst

23RISK

open ↗

Referência

CVE-2009-2263

CVE-2009-2263—

Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include a

23RISK

open ↗

Referência

CVE-2010-2721

CVE-2010-2721—

SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2010-2721

CVE-2010-2721—

SQL injection vulnerability in index.php in RightInPoint Lyrics Script 3.0 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

jGallery 1.3 - 'index.php' Remote File Inclusion

CVE-2007-2158—webappsphp

PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP co

23RISK

open ↗

Referência✓ VexDay Proof

Squirrelcart 1.x - 'cart.php' Remote File Inclusion

CVE-2007-4439—webappsphp

PHP remote file inclusion vulnerability in popup_window.php in Squirrelcart 1.x.x and earlier allows remote attackers to

23RISK

open ↗

Referência✓ VexDay Proof

PEEL CMS 3.x - Admin Hash Extraction / Arbitrary File Upload

CVE-2008-1506—webappsphp

PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpi

23RISK

open ↗

Referência✓ VexDay Proof

Kmita Mail 3.0 - 'file' Remote File Inclusion

CVE-2008-2199—webappsphp

PHP remote file inclusion vulnerability in kmitaadmin/kmitam/htmlcode.php in Kmita Mail 3.0 and earlier, when register_g

23RISK

open ↗

Referência✓ VexDay Proof

Zomplog 3.8.2 - 'newuser.php' Arbitrary Add Admin

CVE-2008-2349—webappsphp

Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direc

23RISK

open ↗

Referência✓ VexDay Proof

PacPoll 4.0 - Database Disclosure

CVE-2008-5981—webappsphp

PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attack

23RISK

open ↗

Referência✓ VexDay Proof

webid 0.5.4 - Multiple Vulnerabilities

CVE-2008-7118—webappsphp

WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allow

23RISK

open ↗

Referência✓ VexDay Proof

moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting

CVE-2009-1369—webappsphp

moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) p

23RISK

open ↗

Referência

CVE-2012-1308

CVE-2012-1308—

Cross-site request forgery (CSRF) vulnerability in redpass.cgi in D-Link DSL-2640B Firmware EU_4.00 allows remote attack

23RISK

open ↗

Referência

CVE-2009-2332

CVE-2009-2332—

CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to in

23RISK

open ↗

Referência

CVE-2010-1741

CVE-2010-1741—

SQL injection vulnerability in request_account.php in Billwerx RC 5.2.2 PL2 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência✓ VexDay Proof

Webace-Linkscript 1.3 SE - 'start.php' SQL Injection

CVE-2007-4846—webappsphp

SQL injection vulnerability in start.php in Webace-Linkscript (wls) 1.3 Special Edition (SE) allows remote attackers to

23RISK

open ↗

Referência

CVE-2009-4466

CVE-2009-4466—

DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which rev

23RISK

open ↗

Referência✓ VexDay Proof

rgboard 3.0.12 - Remote File Inclusioni / Cross-Site Scripting

CVE-2008-2296—webappsphp

PHP remote file inclusion vulnerability in include/bbs.lib.inc.php in Rgboard 3.0.12 allows remote attackers to execute

23RISK

open ↗

Referência

CVE-2015-6911

CVE-2015-6911—

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

OpenEMR 2.8.1 - 'fileroot' Remote File Inclusion

CVE-2006-2929—webappsphp

PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earl

23RISK

open ↗

Referência

CVE-2017-1000371

CVE-2017-1000371—

The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1

23RISK

open ↗

Referência

CVE-2017-1000371

CVE-2017-1000371—

The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.