Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

25,822 exploits

Referência✓ VexDay Proof

Zeeways ZeeJobsite 2.0 - Arbitrary File Upload

CVE-2008-6913—webappsphp

Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated user

23RISK

open ↗

Referência

CVE-2012-6525

CVE-2012-6525—

SQL injection vulnerability in members.php in PHPBridges allows remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2013-4988

CVE-2013-4988—

Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun

50RISK

open ↗

Referência

CVE-2013-4988

CVE-2013-4988—

Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCoun

50RISK

open ↗

Referência✓ VexDay Proof

X10media Mp3 Search Engine 1.5.5 - Remote File Inclusion

CVE-2008-4141—webappsphp

Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to

23RISK

open ↗

Referência

CVE-2019-13101

CVE-2019-13101—

An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without

50RISK

open ↗

Referência✓ VexDay Proof

GNUBoard 4.31.03 (08.12.29) - Local File Inclusion

CVE-2009-0290—webappsphp

Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute a

23RISK

open ↗

Referência✓ VexDay Proof

addalink 4 - 'category_id' SQL Injection

CVE-2008-4145—webappsphp

SQL injection vulnerability in user_read_links.php in Addalink 1.0 beta 4 and earlier, when magic_quotes_gpc is disabled

23RISK

open ↗

Referência

CVE-2010-1870

CVE-2010-1870—

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fishe

60RISK

open ↗

Referência

CVE-2010-1870

CVE-2010-1870—

The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fishe

60RISK

open ↗

Referência

CVE-2012-2962

CVE-2012-2962—

SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2

50RISK

open ↗

Referência

CVE-2013-7260

CVE-2013-7260—

Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before

50RISK

open ↗

Referência

CVE-2016-4657

CVE-2016-4657HIGHunder attack

WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory

98RISK

open ↗

Referência

CVE-2017-11394

CVE-2017-11394—

Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitr

50RISK

open ↗

Referência

CVE-2017-7310

CVE-2017-7310—

A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9

50RISK

open ↗

Referência

CVE-2017-7310

CVE-2017-7310—

A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9

50RISK

open ↗

Referência✓ VexDay Proof

smcFanControl 2.1.2 (OSX) - Multiple Buffer Overflow Vulnerabilities (PoC)

CVE-2008-6252—dososx

Stack-based buffer overflow in the smc program in smcFanControl 2.1.2 allows local users to execute arbitrary code and g

23RISK

open ↗

Referência✓ VexDay Proof

SpeedStream 5200 - Authentication Bypass Configuration Download

CVE-2008-6916—remotehardware

Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host

23RISK

open ↗

Referência

CVE-2017-7310

CVE-2017-7310—

A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9

50RISK

open ↗

Referência

CVE-2018-0953

CVE-2018-0953—

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

35RISK

open ↗

Referência

CVE-2019-14530

CVE-2019-14530—

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

50RISK

open ↗

Referência

CVE-2019-14530

CVE-2019-14530—

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

50RISK

open ↗

Referência

CVE-2019-6443

CVE-2019-6443—

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read

50RISK

open ↗

Referência

CVE-2009-3103

CVE-2009-3103—

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Window

60RISK

open ↗

Referência

CVE-2011-3142

CVE-2011-3142—

Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote att

35RISK

open ↗

Referência✓ VexDay Proof

CYASK 3.x - 'neturl' Local File Disclosure

CVE-2008-4151—webappsphp

Directory traversal vulnerability in collect.php in CYASK 3.x allows remote attackers to read arbitrary files via a .. (

23RISK

open ↗

Referência

CVE-2010-4783

CVE-2010-4783—

Multiple cross-site scripting (XSS) vulnerabilities in index.php in PHP Web Scripts Easy Banner Free 2009.05.18, when ma

23RISK

open ↗

Referência

CVE-2010-4791

CVE-2010-4791—

SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user

23RISK

open ↗

Referência

CVE-2010-4792

CVE-2010-4792—

Cross-site scripting (XSS) vulnerability in title.php in OPEN IT OverLook 5.0 allows remote attackers to inject arbitrar

23RISK

open ↗

Referência

CVE-2008-4157

CVE-2008-4157—

SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.