Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits
39,873CVEs with public exploitation
24,696lab-tested
AllReferência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecentpopularrisk
25,822 exploits
Referência
CVE-2016-7240
CVE-2016-7240—
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a de
35RISK
open ↗
Referência
CVE-2022-1388
CVE-2022-1388CRITICALunder attackransomware
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
Referência
CVE-2022-1388
CVE-2022-1388CRITICALunder attackransomware
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
Referência
CVE-2012-6096
CVE-2012-6096—
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga
50RISK
open ↗
Referência✓ VexDay Proof
Collabtive 0.4.8 - Cross-Site Scripting / Authentication Bypass / Arbitrary File Upload
CVE-2008-6948—webappsphp
Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code b
23RISK
open ↗
Referência✓ VexDay Proof
Joomla! Component com_waticketsystem - Blind SQL Injection
CVE-2009-0333—webappsphp
SQL injection vulnerability in the WebAmoeba (WA) Ticket System (com_waticketsystem) component for Joomla! allows remote
23RISK
open ↗
Referência
CVE-2013-2347
CVE-2013-2347—
The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary
50RISK
open ↗
Referência
CVE-2018-0934
CVE-2018-0934—
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution,
35RISK
open ↗
Referência
CVE-2010-4794
CVE-2010-4794—
Multiple cross-site scripting (XSS) vulnerabilities in the JoomlaSeller JS Calendar (com_jscalendar) component 1.5.1 and
23RISK
open ↗
Referência
CVE-2010-4798
CVE-2010-4798—
Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbit
23RISK
open ↗
Referência
CVE-2010-4834
CVE-2010-4834—
Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allo
23RISK
open ↗
Referência
CVE-2012-6529
CVE-2012-6529—
Multiple SQL injection vulnerabilities in Marinet CMS allow remote attackers to execute arbitrary SQL commands via the i
23RISK
open ↗
Referência
CVE-2013-6194
CVE-2013-6194—
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a
50RISK
open ↗
Referência
CVE-2015-8351
CVE-2015-8351—
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_includ
35RISK
open ↗
Referência
CVE-2015-2295
CVE-2015-2295—
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before
35RISK
open ↗
Referência
CVE-2017-14496
CVE-2017-14496—
Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-su
35RISK
open ↗
Referência
CVE-2015-2295
CVE-2015-2295—
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before
35RISK
open ↗
Referência
CVE-2019-12181
CVE-2019-12181—
A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
50RISK
open ↗
Referência
CVE-2015-8351
CVE-2015-8351—
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_includ
35RISK
open ↗
Referência
CVE-2020-0009
CVE-2020-0009—
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This
23RISK
open ↗
Referência✓ VexDay Proof
Acc Real Estate 4.0 - Insecure Cookie Handling
CVE-2008-6293—webappsphp
admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access b
23RISK
open ↗
Referência✓ VexDay Proof
DD-WRT HTTPd Daemon/Service - Remote Command Execution
CVE-2008-6975—remotehardware
Multiple cross-site request forgery (CSRF) vulnerabilities in apply.cgi in DD-WRT 24 sp2 allow remote attackers to hijac
23RISK
open ↗
Referência
CVE-2010-4872
CVE-2010-4872—
SQL injection vulnerability in newsroom.asp in ASPilot Pilot Cart 7.3 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência✓ VexDay Proof
Pre Real Estate Listings - 'search.php' SQL Injection
CVE-2008-4177—webappsphp
SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2010-4876
CVE-2010-4876—
SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Referência✓ VexDay Proof
FipsCMS 4.5 - 'index.asp' SQL Injection
CVE-2006-6115—webappsasp
SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência
CVE-2010-4894
CVE-2010-4894—
SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL com
23RISK
open ↗
Referência✓ VexDay Proof
PHPOCS 0.1-beta3 - 'act' Local File Inclusion
CVE-2008-4331—webappsphp
Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attacke
23RISK
open ↗
Referência
CVE-2023-30806
CVE-2023-30806CRITICAL
Sangfor Next-Gen Application Firewall PHPSESSID Command Injection
60RISK
open ↗
Referência
CVE-2023-30805
CVE-2023-30805CRITICAL
Sangfor Next-Gen Application Firewall Login Un Param Command Injection
60RISK
open ↗
← previouspage 61 / 861next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.