Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,724cataloged exploits
35,724CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,492GitHub PoC 14,286VulnCheck XDB 8,703Nuclei 4,314Metasploit 3,474✓ verified onlyrecentpopularrisk
22,492 exploits
Referência
CVE-2018-17408
CVE-2018-17408—
Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute a
43RISK
open ↗
Referência
CVE-2022-3900
CVE-2022-3900CRITICAL
Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
53RISK
open ↗
Referência
CVE-2009-2433
CVE-2009-2433—
Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a
28RISK
open ↗
Referência
CVE-2010-1495
CVE-2010-1495—
Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to rea
43RISK
open ↗
Referência
CVE-2010-1495
CVE-2010-1495—
Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to rea
43RISK
open ↗
Referência
CVE-2017-1000375
CVE-2017-1000375—
NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attacke
28RISK
open ↗
Referência
CVE-2012-0985
CVE-2012-0985—
Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wi
28RISK
open ↗
Referência
CVE-2018-4243
CVE-2018-4243—
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
28RISK
open ↗
Referência
CVE-2017-5465
CVE-2017-5465—
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for other
28RISK
open ↗
Referência
CVE-2021-46419
CVE-2021-46419—
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system fil
60RISK
open ↗
Referência
CVE-2010-4409
CVE-2010-4409—
Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows cont
28RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer 6.0.2900 SP2 - CSS Attribute Denial of Service
CVE-2006-7031MEDIUMdoswindows
Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a
38RISK
open ↗
Referência✓ VexDay Proof
Lotus Domino R6 Webmail - Remote Password Hash Dumper
CVE-2007-0977—remotewindows
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.n
43RISK
open ↗
Referência✓ VexDay Proof
VideoLAN VLC Media Player 0.8.6d - 'httpd_FileCallBack' Remote Format String
CVE-2007-6682—remotewindows
Format string vulnerability in the httpd_FileCallBack function (network/httpd.c) in VideoLAN VLC 0.8.6d allows remote at
28RISK
open ↗
Referência
CVE-2018-18323
CVE-2018-18323—
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/
60RISK
open ↗
Referência
CVE-2009-4574
CVE-2009-4574—
SQL injection vulnerability in country_escorts.php in I-Escorts Directory Script allows remote attackers to execute arbi
23RISK
open ↗
Referência
CVE-2018-1321
CVE-2018-1321—
An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un
28RISK
open ↗
Referência
CVE-2018-19423
CVE-2018-19423—
Codiad 2.8.4 allows remote authenticated administrators to execute arbitrary code by uploading an executable file.
28RISK
open ↗
Referência
CVE-2022-31101
CVE-2022-31101HIGH
SQL Injection in prestashop/blockwishlist
61RISK
open ↗
Referência✓ VexDay Proof
Microsoft Windows Media Player - '.mid' Integer Overflow (PoC)
CVE-2009-1331—doswindows
Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of ser
28RISK
open ↗
Referência
CVE-2015-3440
CVE-2015-3440—
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to i
28RISK
open ↗
Referência
CVE-2010-2091
CVE-2010-2091—
Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly
28RISK
open ↗
Referência
CVE-2015-3089
CVE-2015-3089—
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460
35RISK
open ↗
Referência
CVE-2010-1955
CVE-2010-1955—
Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2017-7308
CVE-2017-7308—
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
43RISK
open ↗
Referência
CVE-2017-7308
CVE-2017-7308—
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
43RISK
open ↗
Referência
CVE-2021-24274
CVE-2021-24274—
Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)
43RISK
open ↗
Referência
CVE-2015-2279
CVE-2015-2279—
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows
28RISK
open ↗
Referência
CVE-2015-2279
CVE-2015-2279—
cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows
28RISK
open ↗
Referência
CVE-2016-4176
CVE-2016-4176—
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
28RISK
open ↗
← previouspage 529 / 750next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.