Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
22,301 exploits
Referência
CVE-2017-0287
CVE-2017-0287—
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2017-0313
CVE-2017-0313—
All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implem
23RISK
open ↗
Referência
CVE-2021-47976
CVE-2021-47976HIGH
TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload
41RISK
open ↗
Referência✓ VexDay Proof
doITlive CMS 2.50 - SQL Injection / Cross-Site Scripting
CVE-2008-2842—webappsasp
Cross-site scripting (XSS) vulnerability in edit/showmedia.asp in doITLive CMS 2.50 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Ultimate PHP Board 2.2.1 - Privilege Escalation
CVE-2008-6727—webappsphp
Cross-site scripting (XSS) vulnerability in Ultimate PHP Board (UPB) 2.2.2, 2.2.1, and earlier 2.x versions allows remot
23RISK
open ↗
Referência
CVE-2009-4692
CVE-2009-4692—
Cross-site scripting (XSS) vulnerability in index.php in RadScripts RadLance Gold 7.5 allows remote attackers to inject
23RISK
open ↗
Referência
CVE-2009-4697
CVE-2009-4697—
Multiple cross-site scripting (XSS) vulnerabilities in index.php in RadNICS Gold 5 allow remote attackers to inject arbi
23RISK
open ↗
Referência
CVE-2009-3719
CVE-2009-3719—
Cross-site scripting (XSS) vulnerability in comment.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to
23RISK
open ↗
Referência
CVE-2010-2340
CVE-2010-2340—
SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attacker
23RISK
open ↗
Referência
CVE-2016-7083
CVE-2016-7083—
VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado Thin
23RISK
open ↗
Referência
CVE-2017-16843
CVE-2017-16843—
Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic
23RISK
open ↗
Referência
CVE-2014-125116
CVE-2014-125116CRITICAL
HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
63RISK
open ↗
Referência
CVE-2014-125116
CVE-2014-125116CRITICAL
HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
63RISK
open ↗
Referência
CVE-2014-125116
CVE-2014-125116CRITICAL
HybridAuth 2.0.9 - 2.2.2 Unauthenticated RCE via install.php Configuration Injection
63RISK
open ↗
Referência
CVE-2020-8493
CVE-2020-8493MEDIUM
A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via
33RISK
open ↗
Referência
CVE-2008-6325
CVE-2008-6325—
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Classifieds Script allow remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2009-3562
CVE-2009-3562—
Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 allows remote attackers to inject arbitrary web scri
23RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência
CVE-2011-10010
CVE-2011-10010CRITICAL
QuickShare File Server 1.2.1 Path Traversal RCE
63RISK
open ↗
Referência✓ VexDay Proof
PHP-Fusion 6.01.14 - Blind SQL Injection
CVE-2008-1918—webappsphp
SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magic_quotes_gpc is disabled and the
23RISK
open ↗
Referência
CVE-2009-4857
CVE-2009-4857—
Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary
23RISK
open ↗
Referência
CVE-2009-4523
CVE-2009-4523—
Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
Referência
CVE-2009-4681
CVE-2009-4681—
Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2009-4681
CVE-2009-4681—
Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbit
23RISK
open ↗
Referência
CVE-2007-5647
CVE-2007-5647—
Multiple cross-site scripting (XSS) vulnerabilities in SocketKB 1.1.5 allow remote attackers to inject arbitrary web scr
23RISK
open ↗
Referência✓ VexDay Proof
PHPAuctionSystem - Cross-Site Scripting / SQL Injection
CVE-2009-0107—webappsphp
Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to
23RISK
open ↗
Referência✓ VexDay Proof
Easy Scripts Answer and Question Script - Multiple Vulnerabilities
CVE-2009-1654—webappsphp
Cross-site scripting (XSS) vulnerability in questiondetail.php in Easy Scripts Answer and Question Script allows remote
23RISK
open ↗
Referência
CVE-2009-4601
CVE-2009-4601—
Cross-site scripting (XSS) vulnerability in basic_search_result.php in Zeeways ZeeJobsite 3x allows remote attackers to
23RISK
open ↗
← previouspage 434 / 744next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.