Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,866cataloged exploits
35,812CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
22,549 exploits
Referência
CVE-2017-0282
CVE-2017-0282—
Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT
23RISK
open ↗
Referência
CVE-2010-5007
CVE-2010-5007—
Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
ClaSS 0.8.60 - 'export.php' Local File Inclusion
CVE-2008-5856—webappsphp
Directory traversal vulnerability in scripts/export.php in ClaSS before 0.8.61 allows remote attackers to read arbitrary
23RISK
open ↗
Referência
CVE-2014-4019
CVE-2014-4019—
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient
28RISK
open ↗
Referência
CVE-2009-4427
CVE-2009-4427—
Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbi
23RISK
open ↗
Referência
CVE-2018-7216
CVE-2018-7216—
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal al
23RISK
open ↗
Referência
CVE-2018-7216
CVE-2018-7216—
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal al
23RISK
open ↗
Referência
CVE-2017-16783
CVE-2017-16783—
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
23RISK
open ↗
Referência
CVE-2010-5007
CVE-2010-5007—
Cross-site scripting (XSS) vulnerability in pages/match_report.php in UTStats Beta 4 and earlier allows remote attackers
23RISK
open ↗
Referência
CVE-2019-14280
CVE-2019-14280—
In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images whe
23RISK
open ↗
Referência
CVE-2009-4430
CVE-2009-4430—
SQL injection vulnerability in index.php in VirtueMart 1.0 allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
LightCMS 1.3.4 - 'exclusive' Stored XSS
CVE-2021-3355—webappsmultiple
A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Tit
23RISK
open ↗
Referência✓ VexDay Proof
MODx CMS 0.9.2.1 - 'FCKeditor' Remote File Inclusion
CVE-2006-5730—webappsphp
PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS
23RISK
open ↗
Referência✓ VexDay Proof
Durian Web Application Server 3.02 - Remote Buffer Overflow
CVE-2006-6853—remotewindows
Buffer overflow in Durian Web Application Server 3.02 freeware on Windows allows remote attackers to execute arbitrary c
23RISK
open ↗
Referência✓ VexDay Proof
Lanius CMS 1.2.16 - 'FCKeditor' Arbitrary File Upload
CVE-2007-5156—webappsphp
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.
23RISK
open ↗
Referência✓ VexDay Proof
Ax Developer CMS 0.1.1 - 'index.php?module' Local File Inclusion
CVE-2007-5820—webappsphp
Directory traversal vulnerability in index.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to include and
23RISK
open ↗
Referência✓ VexDay Proof
eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities
CVE-2008-2861—webappsphp
Multiple cross-site scripting (XSS) vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote atta
23RISK
open ↗
Referência✓ VexDay Proof
pPIM 1.0 - Arbitrary File Delete / Cross-Site Scripting
CVE-2008-4425—webappsphp
Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote att
23RISK
open ↗
Referência
CVE-2009-3042
CVE-2009-3042—
SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attacke
23RISK
open ↗
Referência
CVE-2006-5629
CVE-2006-5629—
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arb
23RISK
open ↗
Referência
CVE-2009-3362
CVE-2009-3362—
PHP remote file inclusion vulnerability in printnews.php3 in SZNews 2.7 allows remote attackers to execute arbitrary PHP
23RISK
open ↗
Referência
CVE-2012-0902
CVE-2012-0902—
AirTies Air 4450 1.1.2.18 allows remote attackers to cause a denial of service (reboot) via a direct request to cgi-bin/
23RISK
open ↗
Referência
CVE-2017-6089
CVE-2017-6089—
SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗
Referência
CVE-2013-3728
CVE-2013-3728—
Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissio
23RISK
open ↗
Referência
CVE-2016-3986
CVE-2016-3986—
Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a
23RISK
open ↗
Referência
CVE-2011-4670
CVE-2011-4670—
Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2011-4670
CVE-2011-4670—
Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arb
23RISK
open ↗
Referência
CVE-2018-11508
CVE-2018-11508—
The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitiv
23RISK
open ↗
Referência
CVE-2010-4792
CVE-2010-4792—
Cross-site scripting (XSS) vulnerability in title.php in OPEN IT OverLook 5.0 allows remote attackers to inject arbitrar
23RISK
open ↗
Referência
CVE-2010-5042
CVE-2010-5042—
Cross-site scripting (XSS) vulnerability in the DJ-ArtGallery (com_djartgallery) component 0.9.1 for Joomla! allows remo
23RISK
open ↗
← previouspage 586 / 752next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.