Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,337cataloged exploits

39,873CVEs with public exploitation

24,696lab-tested

All Referência 25,822Exploit-DB 24,487GitHub PoC 17,115VulnCheck XDB 9,874Nuclei 4,511Metasploit 3,528✓ verified onlyrecent popular risk

25,822 exploits

Referência

CVE-2018-6328

CVE-2018-6328—

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w

50RISK

open ↗

Referência

CVE-2020-0601

CVE-2020-0601HIGHunder attack

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RISK

open ↗

Referência

CVE-2010-4279

CVE-2010-4279—

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al

50RISK

open ↗

Referência

CVE-2017-14147

CVE-2017-14147—

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea

35RISK

open ↗

Referência

CVE-2018-0835

CVE-2018-0835—

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remot

35RISK

open ↗

Referência

CVE-2018-6328

CVE-2018-6328—

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w

50RISK

open ↗

Referência

CVE-2026-108815

CVE-2026-108815MEDIUM

idcCMS member_deal.php cross site scripting

33RISK

open ↗

Referência

CVE-2010-4279

CVE-2010-4279—

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which al

50RISK

open ↗

Referência

CVE-2011-3175

CVE-2011-3175—

Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allo

50RISK

open ↗

Referência

CVE-2010-4902

CVE-2010-4902—

Multiple SQL injection vulnerabilities in the Clantools (com_clantools) component 1.2.3 for Joomla! allow remote attacke

23RISK

open ↗

Referência

CVE-2017-14147

CVE-2017-14147—

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to ea

35RISK

open ↗

Referência✓ VexDay Proof

fipsForum 2.6 - 'default2.asp' SQL Injection

CVE-2006-6116—webappsasp

SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQ

23RISK

open ↗

Referência✓ VexDay Proof

TFTP Server for Windows 1.4 - ST Remote BSS Overflow

CVE-2008-2161—remotewindows

Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execut

50RISK

open ↗

Referência

CVE-2024-3272

CVE-2024-3272CRITICALunder attack

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

100RISK

open ↗

Referência✓ VexDay Proof

WEBalbum 2.4b - 'id' Blind SQL Injection

CVE-2009-0446—webappsphp

SQL injection vulnerability in photo.php in WEBalbum 2.4b allows remote attackers to execute arbitrary SQL commands via

23RISK

open ↗

Referência

CVE-2012-3399

CVE-2012-3399—

Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the

50RISK

open ↗

Referência✓ VexDay Proof

Micro CMS 0.3.5 - 'microcms_path' Remote File Inclusion

CVE-2006-3144—webappsphp

PHP remote file inclusion vulnerability in micro_cms_files/microcms-include.php in Implied By Design (IBD) Micro CMS 3.5

23RISK

open ↗

Referência

CVE-2017-11811

CVE-2017-11811—

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker

35RISK

open ↗

Referência

CVE-2018-0767

CVE-2018-0767—

Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain info

35RISK

open ↗

Referência

CVE-2018-19422

CVE-2018-19422—

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, beca

50RISK

open ↗

Referência

CVE-2018-19422

CVE-2018-19422—

/panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, beca

50RISK

open ↗

Referência

CVE-2019-6977

CVE-2019-6977—

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch funct

45RISK

open ↗

Referência

CVE-2019-6977

CVE-2019-6977—

gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch funct

45RISK

open ↗

Referência✓ VexDay Proof

SkaLinks 1.5 - Authentication Bypass

CVE-2009-0451—webappsphp

SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Adm

23RISK

open ↗

Referência

CVE-2010-4910

CVE-2010-4910—

SQL injection vulnerability in index.cfm in ColdGen ColdCalendar 2.06 allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2010-4916

CVE-2010-4916—

Multiple SQL injection vulnerabilities in index.cfm in ColdGen ColdUserGroup 1.06 allow remote attackers to execute arbi

23RISK

open ↗

Referência✓ VexDay Proof

WebCMS Portal Edition - 'id' Blind SQL Injection

CVE-2008-4185—webappsphp

SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL comma

23RISK

open ↗

Referência

CVE-2010-4926

CVE-2010-4926—

SQL injection vulnerability in the TimeTrack (com_timetrack) component 1.2.4 for Joomla! allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2010-4926

CVE-2010-4926—

SQL injection vulnerability in the TimeTrack (com_timetrack) component 1.2.4 for Joomla! allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2010-4929

CVE-2010-4929—

SQL injection vulnerability in the Joostina (com_ezautos) component for Joomla! allows remote attackers to execute arbit

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.