Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
22,367 exploits
Referência✓ VexDay Proof
xml2owl 0.1.1 - 'filedownload.php' Remote File Disclosure
CVE-2007-6322—webappsphp
Directory traversal vulnerability in filedownload.php in xml2owl 0.1.1 allows remote attackers to read arbitrary files v
23RISK
open ↗
Referência✓ VexDay Proof
HP Compaq Notebooks - ActiveX Remote Code Execution
CVE-2007-6331—remotewindows
Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP
35RISK
open ↗
Referência✓ VexDay Proof
HP Compaq Notebooks - ActiveX Remote Code Execution
CVE-2007-6333—remotewindows
The HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfocenter.exe) 1.0.1.1 i
23RISK
open ↗
Referência✓ VexDay Proof
ClamAV 0.91.2 - libclamav MEW PE Buffer Overflow
CVE-2007-6335—remotelinux
Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW
28RISK
open ↗
Referência✓ VexDay Proof
SineCMS 2.3.4 - Calendar SQL Injection
CVE-2007-6366—webappsphp
Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL comm
23RISK
open ↗
Referência✓ VexDay Proof
WordPress Plugin PictPress 0.91 - Remote File Disclosure
CVE-2007-6369—webappsphp
Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow
23RISK
open ↗
Referência✓ VexDay Proof
BadBlue 2.72 - PassThru Remote Buffer Overflow
CVE-2007-6377—remotewindows
Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attacker
50RISK
open ↗
Referência
CVE-2018-12524
CVE-2018-12524—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provi
23RISK
open ↗
Referência
CVE-2018-13108
CVE-2018-13108—
All ADB broadband gateways / routers based on the Epicentro platform are affected by a local root jailbreak vulnerabilit
23RISK
open ↗
Referência
CVE-2018-12525
CVE-2018-12525—
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /images/ pr
23RISK
open ↗
Referência
CVE-2018-12584
CVE-2018-12584—
The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows rem
28RISK
open ↗
Referência
CVE-2018-12584
CVE-2018-12584—
The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows rem
28RISK
open ↗
Referência
CVE-2018-12604
CVE-2018-12604—
GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_d
28RISK
open ↗
Referência
CVE-2018-12613
CVE-2018-12613—
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISK
open ↗
Referência
CVE-2018-12613
CVE-2018-12613—
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISK
open ↗
Referência
CVE-2018-12613
CVE-2018-12613—
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISK
open ↗
Referência
CVE-2018-12908
CVE-2018-12908—
Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensiti
28RISK
open ↗
Referência
CVE-2018-12912
CVE-2018-12912—
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via a
23RISK
open ↗
Referência
MCL-Net 4.3.5.8788 - Information Disclosure
CVE-2023-34834—webappshardware
A Directory Browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attacker
23RISK
open ↗
Referência
CVE-2018-14485
CVE-2018-14485—
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
28RISK
open ↗
Referência
CVE-2018-14575
CVE-2018-14575—
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CS
23RISK
open ↗
Referência
CVE-2018-14728
CVE-2018-14728—
upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
60RISK
open ↗
Referência
CVE-2018-14894
CVE-2018-14894—
CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file
23RISK
open ↗
Referência✓ VexDay Proof
Vantage Linguistics AnswerWorks 4 - API ActiveX Control Buffer Overflow
CVE-2007-6387—remotewindows
Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Van
35RISK
open ↗
Referência✓ VexDay Proof
SH-News 3.0 - 'comments.php' SQL Injection
CVE-2007-6391—webappsphp
SQL injection vulnerability in patch/comments.php in SH-News 3.0 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗
Referência✓ VexDay Proof
Ace Image Hosting Script - 'id' SQL Injection
CVE-2007-6393—webappsphp
SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbit
23RISK
open ↗
Referência✓ VexDay Proof
Adult Script 1.6 - Unauthorized Administrative Access
CVE-2007-6414—webappsphp
admin/administrator.php in Adult Script 1.6 and earlier sends a redirect to the web browser but does not exit, which all
23RISK
open ↗
Referência✓ VexDay Proof
Form Tools 1.5.0b - Multiple Remote File Inclusions
CVE-2007-6464—webappsphp
Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência✓ VexDay Proof
FreeWebShop 2.2.1 - Blind SQL Injection
CVE-2007-6466—webappsphp
Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
CVE-2007-6490—webappsphp
Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a passw
23RISK
open ↗
← previouspage 465 / 746next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.