Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,620cataloged exploits

35,647CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecent popular risk

22,429 exploits

Referência

CVE-2015-7652

CVE-2015-7652—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and

28RISK

open ↗

Referência

CVE-2012-5611

CVE-2012-5611—

Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53

28RISK

open ↗

Referência

CVE-2010-3714

CVE-2010-3714—

The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before

43RISK

open ↗

Referência

CVE-2010-5300

CVE-2010-5300—

Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash

28RISK

open ↗

Referência

CVE-2020-10884

CVE-2020-10884HIGH

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer

61RISK

open ↗

Referência

CVE-2019-13360

CVE-2019-13360—

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login pro

28RISK

open ↗

Referência

CVE-2015-7563

CVE-2015-7563—

Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the aut

23RISK

open ↗

Referência

CVE-2018-4934

CVE-2018-4934—

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful expl

28RISK

open ↗

Referência

CVE-2009-2307

CVE-2009-2307—

SQL injection vulnerability in the CWGuestBook module 2.1 and earlier for MAXdev MDPro (aka MD-Pro) allows remote attack

23RISK

open ↗

Referência

CVE-2008-2789

CVE-2008-2789—

SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi

43RISK

open ↗

Referência

CVE-2011-1938

CVE-2011-1938—

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might all

28RISK

open ↗

Referência

CVE-2017-17640

CVE-2017-17640—

Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country pa

23RISK

open ↗

Referência✓ VexDay Proof

ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass

CVE-2007-6232—webappsphp

Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web

23RISK

open ↗

Referência

CVE-2021-40380

CVE-2021-40380—

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and set

28RISK

open ↗

Referência

CVE-2013-1360

CVE-2013-1360—

An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7

28RISK

open ↗

Referência

CVE-2016-9565

CVE-2016-9565—

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write

28RISK

open ↗

Referência

CVE-2016-9565

CVE-2016-9565—

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write

28RISK

open ↗

Referência

CVE-2014-7864

CVE-2014-7864—

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpMan

28RISK

open ↗

Referência

CVE-2009-2311

CVE-2009-2311—

SQL injection vulnerability in the rGallery plugin 1.2.3 for WoltLab Burning Board (WBB3) allows remote attackers to exe

23RISK

open ↗

Referência

CVE-2009-2313

CVE-2009-2313—

Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to inclu

23RISK

open ↗

Referência

CVE-2013-1592

CVE-2013-1592—

A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending speci

28RISK

open ↗

Referência

CVE-2016-6367

CVE-2016-6367HIGHunder attack

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows loc

76RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows Media Player - '.AIFF' Divide By Zero Exception Denial of Service (PoC)

CVE-2007-6236—doswindows

Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a cert

28RISK

open ↗

Referência

CVE-2014-3936

CVE-2014-3936—

Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06

60RISK

open ↗

Referência

CVE-2009-4905

CVE-2009-4905—

Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in Acc Statistics 1.1 allow remote attackers to

23RISK

open ↗

Referência

CVE-2017-5586

CVE-2017-5586—

OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a craf

28RISK

open ↗

Referência

CVE-2017-5586

CVE-2017-5586—

OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a craf

28RISK

open ↗

Referência

CVE-2020-11107

CVE-2020-11107—

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged

28RISK

open ↗

Referência

CVE-2009-4906

CVE-2009-4906—

Cross-site request forgery (CSRF) vulnerability in index.php in Acc PHP eMail 1.1 allows remote attackers to hijack the

23RISK

open ↗

Referência

CVE-2009-4907

CVE-2009-4907—

Multiple cross-site request forgery (CSRF) vulnerabilities in oBlog allow remote attackers to hijack the authentication

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.