Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
26,327 exploits
Referência✓ VexDay Proof
Web Directory Script 2.0 - 'name' SQL Injection
CVE-2008-3787—webappsphp
SQL injection vulnerability in listing_view.php in Web Directory Script 2.0 and earlier allows remote attackers to execu
23RISK
open ↗
Referência
CVE-2009-2881
CVE-2009-2881—
Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗
Referência
CVE-2009-3758
CVE-2009-3758—
SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remo
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component mad4Joomla! - SQL Injection
CVE-2008-6181—webappsphp
SQL injection vulnerability in the Mad4Joomla Mailforms (com_mad4joomla) component before 1.1.8.2 for Joomla! allows rem
23RISK
open ↗
Referência
CVE-2010-1704
CVE-2010-1704—
Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2010-1704
CVE-2010-1704—
Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2010-4750
CVE-2010-4750—
Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allow
23RISK
open ↗
Referência
CVE-2010-4750
CVE-2010-4750—
Cross-site request forgery (CSRF) vulnerability in admin/libs/ADMIN.php in BLOG:CMS 4.2.1.e, and possibly earlier, allow
23RISK
open ↗
Referência✓ VexDay Proof
PsychoStats 2.3.3 - Multiple SQL Injections
CVE-2008-6422—webappsphp
Multiple SQL injection vulnerabilities in PsychoStats 2.3, 2.3.1, and 2.3.3 allow remote attackers to execute arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
minimal ablog 0.4 - SQL Injection / Arbitrary File Upload / Authentication Bypass
CVE-2008-6611—webappsphp
SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência
CVE-2009-2921
CVE-2009-2921—
Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP News 1.1 allow remote attackers to execute arbitr
23RISK
open ↗
Referência
CVE-2010-4800
CVE-2010-4800—
SQL injection vulnerability in doadd.php in BaconMap 1.0 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗
Referência
CVE-2010-4801
CVE-2010-4801—
Directory traversal vulnerability in admin/updatelist.php in BaconMap 1.0 allows remote attackers to include and execute
23RISK
open ↗
Referência
CVE-2008-3125
CVE-2008-3125—
SQL injection vulnerability in index.php in Mole Group Lastminute Script 4.0 allows remote attackers to execute arbitrar
23RISK
open ↗
Referência
CVE-2016-8641
CVE-2016-8641MEDIUM
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary fil
33RISK
open ↗
Referência✓ VexDay Proof
DELTAScripts PHP Classifieds 7.5 - Authentication Bypass
CVE-2008-5806—webappsphp
SQL injection vulnerability in login.php in DeltaScripts PHP Classifieds 7.5 and earlier allows remote attackers to exec
23RISK
open ↗
Referência
CVE-2010-0800
CVE-2010-0800—
SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allo
23RISK
open ↗
Referência
CVE-2012-5098
CVE-2012-5098—
Multiple SQL injection vulnerabilities in Php-X-Links, possibly 1.0, allow remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2022-46966
CVE-2022-46966CRITICAL
Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
48RISK
open ↗
Referência
CVE-2016-1000
CVE-2016-1000—
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows
28RISK
open ↗
Referência
CVE-2010-0964
CVE-2010-0964—
SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2010-4834
CVE-2010-4834—
Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allo
23RISK
open ↗
Referência✓ VexDay Proof
MaxCMS 2.0 - '/inc/ajax.asp' SQL Injection
CVE-2009-1764—webappsasp
SQL injection vulnerability in inc/ajax.asp in MaxCMS 2.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2010-0964
CVE-2010-0964—
SQL injection vulnerability in start.php in Eros Webkatalog allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência
CVE-2010-1716
CVE-2010-1716—
SQL injection vulnerability in the Agenda Address Book (com_agenda) component 1.0.1 for Joomla! allows remote attackers
23RISK
open ↗
Referência
CVE-2018-10809
CVE-2018-10809—
In 2345 Security Guard 3.7, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD)
23RISK
open ↗
Referência
CVE-2018-6593
CVE-2018-6593—
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows
23RISK
open ↗
Referência
CVE-2019-18862
CVE-2019-18862—
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode.
23RISK
open ↗
Referência
Newgen Correspondence Management System (corms) eGov 12.0 - IDOR
CVE-2020-35737—webappsmultiple
In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information
28RISK
open ↗
Referência
CVE-2012-10033
CVE-2012-10033CRITICAL
Narcissus backend.php Image Configuration Command Injection
63RISK
open ↗
← previouspage 506 / 878next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.