Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,772cataloged exploits
35,760CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,523GitHub PoC 14,289VulnCheck XDB 8,710Nuclei 4,319Metasploit 3,476✓ verified onlyrecentpopularrisk
22,523 exploits
Referência
CVE-2014-8555
Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attack
23RISK
open ↗Referência
CVE-2014-8555
Directory traversal vulnerability in report/reportViewAction.jsp in Progress Software OpenEdge 11.2 allows remote attack
23RISK
open ↗Referência
CVE-2012-0282
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
23RISK
open ↗Referência
CVE-2014-4971
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISK
open ↗Referência
CVE-2009-2256
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial o
23RISK
open ↗Referência✓ VexDay Proof
Pie Cart Pro - 'Inc_Dir' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in WAHM E-Commerce Pie Cart Pro allow remote attackers to execute arb
23RISK
open ↗Referência
CVE-2017-14521
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.
23RISK
open ↗Referência
CVE-2009-3321
SQL injection vulnerability in SaphpLesson 4.3, when magic_quotes_gpc is disabled, allows remote attackers to execute ar
23RISK
open ↗Referência
CVE-2010-4810
Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
JSBoard 2.0.10 - 'login.php?table' Local File Inclusion
Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute a
23RISK
open ↗Referência✓ VexDay Proof
XOOPS Module XFsection - 'modify.php' Remote File Inclusion
PHP remote file inclusion vulnerability in modify.php in the XFsection 1.07 module for XOOPS allows remote attackers to
23RISK
open ↗Referência✓ VexDay Proof
MicroTik RouterOS 3.2 - SNMPd snmp-set Denial of Service
SNMPd in MikroTik RouterOS 3.2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a cra
23RISK
open ↗Referência✓ VexDay Proof
KwsPHP Module jeuxflash 1.0 - 'cat' SQL Injection
SQL injection vulnerability in the jeuxflash module for KwsPHP allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Referência
CVE-2021-21972
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗Referência
CVE-2015-4127
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t
38RISK
open ↗Referência
CVE-2015-4127
Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers t
38RISK
open ↗Referência
CVE-2021-21972
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗Referência
CVE-2017-13261
In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check. T
23RISK
open ↗Referência
CVE-2017-13261
In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check. T
23RISK
open ↗Referência
CVE-2015-7647
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux all
28RISK
open ↗Referência
CVE-2018-9107
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing exte
23RISK
open ↗Referência
CVE-2010-4814
SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attacke
23RISK
open ↗Referência
CVE-2018-7690
MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access
33RISK
open ↗Referência
CVE-2014-2009
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path
23RISK
open ↗Referência
CVE-2010-4814
SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attacke
23RISK
open ↗Referência
CVE-2010-4839
SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to e
23RISK
open ↗Referência✓ VexDay Proof
CMS Creamotion - 'securite.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP cod
23RISK
open ↗Referência✓ VexDay Proof
Blogator-script 0.95 - 'incl_page' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbi
23RISK
open ↗Referência
CVE-2017-7456
Moxa MXView 2.8 allows remote attackers to cause a Denial of Service by sending overly long junk payload for the MXView
28RISK
open ↗Referência
CVE-2018-2380
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information pr
68RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.