Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
25,629 exploits
Referência
CVE-2015-3087
CVE-2015-3087—
Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and
45RISK
open ↗
Referência
CVE-2016-9244
CVE-2016-9244—
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may
45RISK
open ↗
Referência
CVE-2020-8813
CVE-2020-8813—
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RISK
open ↗
Referência
CVE-2016-9244
CVE-2016-9244—
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may
45RISK
open ↗
Referência✓ VexDay Proof
Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting
CVE-2008-2997—webappsphp
Cross-site scripting (XSS) vulnerability in index.php in Gravity Board X (GBX) 2.0 Beta allows remote attackers to injec
23RISK
open ↗
Referência
CVE-2015-8249
CVE-2015-8249—
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
60RISK
open ↗
Referência
CVE-2018-20526
CVE-2018-20526—
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
60RISK
open ↗
Referência
CVE-2015-8249
CVE-2015-8249—
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
60RISK
open ↗
Referência
CVE-2018-20526
CVE-2018-20526—
Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.
60RISK
open ↗
Referência✓ VexDay Proof
Multi SEO phpBB 1.1.0 - Remote File Inclusion
CVE-2008-6377—webappsphp
PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execut
23RISK
open ↗
Referência
CVE-2021-44848
CVE-2021-44848—
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reques
43RISK
open ↗
Referência✓ VexDay Proof
BlogHelper - Remote Configuration File Disclosure
CVE-2009-0826—webappsphp
BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to do
23RISK
open ↗
Referência
CVE-2010-1549
CVE-2010-1549—
Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote
60RISK
open ↗
Referência
CVE-2012-4891
CVE-2012-4891—
Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers t
23RISK
open ↗
Referência✓ VexDay Proof
BXCP 0.2.9.9 - 'tid' SQL Injection
CVE-2006-0821—webappsphp
SQL injection vulnerability in index.php in BXCP 0.299 allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗
Referência✓ VexDay Proof
Userlocator 3.0 - Blind SQL Injection
CVE-2008-5863—webappsphp
SQL injection vulnerability in locator.php in the Userlocator module 3.0 for Woltlab Burning Board (wBB) allows remote a
23RISK
open ↗
Referência
CVE-2018-0824
CVE-2018-0824HIGHunder attack
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized
100RISK
open ↗
Referência✓ VexDay Proof
Rapid Classified 3.1 - Database Disclosure
CVE-2008-6388—webappsphp
Rapid Classified 3.1 and 3.15 stores sensitive information under the web root with insufficient access control, which al
23RISK
open ↗
Referência
CVE-2019-7256
CVE-2019-7256CRITICALunder attack
Linear eMerge E3-Series devices allow Command Injections.
100RISK
open ↗
Referência✓ VexDay Proof
GDL 4.x - 'node' SQL Injection
CVE-2009-0965—webappsphp
SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers
23RISK
open ↗
Referência
CVE-2021-45092
CVE-2021-45092—
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection vi
50RISK
open ↗
Referência
CVE-2014-5073
CVE-2014-5073—
vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands
60RISK
open ↗
Referência✓ VexDay Proof
ArticleBeach Script 2.0 - 'index.php' Remote File Inclusion
CVE-2006-5590—webappsphp
PHP remote file inclusion vulnerability in index.php in ArticleBeach Script 2.0 and earlier allows remote attackers to e
23RISK
open ↗
Referência✓ VexDay Proof
GestArt Beta 1 - 'aide.php?aide' Remote File Inclusion
CVE-2006-5612—webappsphp
PHP remote file inclusion vulnerability in aide.php3 (aka aide.php) in GestArt beta 1, when register_globals is enabled,
23RISK
open ↗
Referência✓ VexDay Proof
Download Accelerator Plus DAP 8.x - '.m3u' Local Buffer Overflow
CVE-2008-3182—localwindows
Stack-based buffer overflow in DAP.exe in Download Accelerator Plus (DAP) 7.0.1.3, 8.6.6.3, and other 8.x versions allow
23RISK
open ↗
Referência✓ VexDay Proof
PHPizabi 0.848b C1 HFP1 - Remote Code Execution
CVE-2008-3239—webappsphp
Unrestricted file upload vulnerability in the writeLogEntry function in system/v_cron_proc.php in PHPizabi 0.848b C1 HFP
23RISK
open ↗
Referência
CVE-2011-5007
CVE-2011-5007—
Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB
60RISK
open ↗
Referência
CVE-2021-40449
CVE-2021-40449HIGHunder attackransomware
Win32k Elevation of Privilege Vulnerability
100RISK
open ↗
Referência
CVE-2010-3891
CVE-2010-3891—
Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind En
23RISK
open ↗
Referência
CVE-2011-0762
CVE-2011-0762—
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a deni
60RISK
open ↗
← previouspage 47 / 855next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.