Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,724cataloged exploits

35,724CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecent popular risk

22,429 exploits

Referência

CVE-2022-28080

CVE-2022-28080—

Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

50RISK

open ↗

Referência

CVE-2015-5453

CVE-2015-5453—

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell

50RISK

open ↗

Referência

CVE-2015-5453

CVE-2015-5453—

Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell

50RISK

open ↗

Referência

CVE-2015-2997

CVE-2015-2997—

SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the account

50RISK

open ↗

Referência

CVE-2010-1470

CVE-2010-1470—

Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read ar

43RISK

open ↗

Referência✓ VexDay Proof

campus virtual-lms - Cross-Site Scripting / SQL Injection

CVE-2009-2148—webappsphp

SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência✓ VexDay Proof

adaptweb 0.9.2 - Local File Inclusion / SQL Injection

CVE-2009-2152—webappsphp

SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands v

23RISK

open ↗

Referência✓ VexDay Proof

impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting

CVE-2009-2154—webappsphp

SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows

23RISK

open ↗

Referência

CVE-2009-3330

CVE-2009-3330—

SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers

23RISK

open ↗

Referência

CVE-2015-3080

CVE-2015-3080—

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows

35RISK

open ↗

Referência

CVE-2015-4074

CVE-2015-4074—

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar

50RISK

open ↗

Referência

CVE-2015-4074

CVE-2015-4074—

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read ar

50RISK

open ↗

Referência

CVE-2013-0249

CVE-2013-0249—

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7

28RISK

open ↗

Referência

CVE-2016-0784

CVE-2016-0784—

Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1

35RISK

open ↗

Referência

CVE-2016-0784

CVE-2016-0784—

Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1

35RISK

open ↗

Referência★ 19

watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256

CVE-2025-25256CRITICAL

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vul

75RISK

open ↗

Referência

CVE-2015-0313

CVE-2015-0313HIGHunder attack

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows

100RISK

open ↗

Referência✓ VexDay Proof

Microsoft Windows - GDI Image Parsing Stack Overflow (MS08-021)

CVE-2008-1087—localwindows

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 200

35RISK

open ↗

Referência✓ VexDay Proof

iDB 0.2.5pa SVN 243 - 'skin' Local File Inclusion

CVE-2009-1498—webappsphp

Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alp

23RISK

open ↗

Referência

CVE-2017-6019

CVE-2017-6019—

An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830

35RISK

open ↗

Referência

CVE-2019-8387

CVE-2019-8387—

MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.

35RISK

open ↗

Referência

CVE-2022-21882

CVE-2022-21882HIGHunder attackransomware

Win32k Elevation of Privilege Vulnerability

98RISK

open ↗

Referência

CVE-2014-7236

CVE-2014-7236—

Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary

50RISK

open ↗

Referência

CVE-2014-4114

CVE-2014-4114HIGHunder attack

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2

100RISK

open ↗

Referência

CVE-2018-17440

CVE-2018-17440—

An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. They expose an FTP server that serves b

35RISK

open ↗

Referência

CVE-2017-13872

CVE-2017-13872—

An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The is

50RISK

open ↗

Referência

CVE-2017-13872

CVE-2017-13872—

An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The is

50RISK

open ↗

Referência

CVE-2015-3042

CVE-2015-3042—

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457

35RISK

open ↗

Referência

CVE-2017-9798

CVE-2017-9798—

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user

60RISK

open ↗

Referência

CVE-2009-3361

CVE-2009-3361—

SQL injection vulnerability in index.php in PHP-IPNMonitor allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.