Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,056cataloged exploits

35,925CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,640GitHub PoC 14,392VulnCheck XDB 8,755Nuclei 4,333Metasploit 3,478✓ verified onlyrecent popular risk

22,640 exploits

Referência

CVE-2020-8776

CVE-2020-8776—

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a

23RISK

open ↗

Referência✓ VexDay Proof

eLineStudio Site Composer (ESC) 2.6 - Multiple Vulnerabilities

CVE-2008-2862—webappsphp

Multiple SQL injection vulnerabilities in eLineStudio Site Composer (ESC) 2.6 and earlier allow remote attackers to exec

23RISK

open ↗

Referência✓ VexDay Proof

Ascended Guestbook 1.0.0 - 'embedded.php' File Inclusion

CVE-2006-5531—webappsphp

PHP remote file inclusion vulnerability in embedded.php in Ascended Guestbook 1.0.0 and earlier allows remote attackers

23RISK

open ↗

Referência✓ VexDay Proof

FishCart 3.2 RC2 - 'fc_example.php' Remote File Inclusion

CVE-2007-4287—webappsphp

PHP remote file inclusion vulnerability in fc_functions/fc_example.php in FishCart 3.2 RC2 and earlier allows remote att

23RISK

open ↗

Referência✓ VexDay Proof

NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection

CVE-2008-6180—webappsphp

SQL injection vulnerability in system/nlb_user.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows

23RISK

open ↗

Referência✓ VexDay Proof

Simple HTTPd 1.38 - Multiple Vulnerabilities

CVE-2007-6405—remotewindows

Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI progra

23RISK

open ↗

Referência✓ VexDay Proof

Mapbender 2.4.4 - 'gaz' SQL Injection

CVE-2008-0301—webappsphp

Multiple SQL injection vulnerabilities in Mapbender 2.4.4 allow remote attackers to execute arbitrary SQL commands via t

23RISK

open ↗

Referência

CVE-2012-6047

CVE-2012-6047—

Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the aut

23RISK

open ↗

Referência

CVE-2017-15977

CVE-2017-15977—

Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.

23RISK

open ↗

Referência✓ VexDay Proof

FreeCMS.us 0.2 - 'index.php' SQL Injection

CVE-2008-2796—webappsphp

SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência

CVE-2022-22947

CVE-2022-22947CRITICALunder attack

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RISK

open ↗

Referência

CVE-2011-4066

CVE-2011-4066—

SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary S

23RISK

open ↗

Referência✓ VexDay Proof

mystats - 'hits.php' Multiple Vulnerabilities

CVE-2008-4644—webappsphp

hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For H

23RISK

open ↗

Referência✓ VexDay Proof

Yerba SACphp 6.3 - Multiple Vulnerabilities

CVE-2008-5873—webappsphp

Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galle

23RISK

open ↗

Referência✓ VexDay Proof

ravennuke 2.3.0 - Multiple Vulnerabilities

CVE-2009-0673—webappsphp

Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.3

23RISK

open ↗

Referência

CVE-2017-17873

CVE-2017-17873—

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.

23RISK

open ↗

Referência

CVE-2017-17872

CVE-2017-17872—

The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.

23RISK

open ↗

Referência

CVE-2017-17871

CVE-2017-17871—

The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action

23RISK

open ↗

Referência

CVE-2010-1535

CVE-2010-1535—

Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers

43RISK

open ↗

Referência

CVE-2012-6516

CVE-2012-6516—

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via th

23RISK

open ↗

Referência

CVE-2014-8674

CVE-2014-8674—

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc

23RISK

open ↗

Referência

CVE-2014-8674

CVE-2014-8674—

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the doc

23RISK

open ↗

Referência✓ VexDay Proof

OWL Intranet Engine 0.82 - 'xrms_file_root' Code Execution

CVE-2006-1149—webappsphp

PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled

23RISK

open ↗

Referência

CVE-2015-2994

CVE-2015-2994—

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators t

50RISK

open ↗

Referência

CVE-2012-6519

CVE-2012-6519—

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL co

23RISK

open ↗

Referência

LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting

CVE-2020-29240—webappsphp

Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of t

23RISK

open ↗

Referência✓ VexDay Proof

CcMail 1.0.1 - 'functions_dir' Remote File Inclusion

CVE-2007-1516—webappsphp

PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to exe

23RISK

open ↗

Referência

CVE-2013-5317

CVE-2013-5317—

Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web scri

23RISK

open ↗

Referência

CVE-2013-5317

CVE-2013-5317—

Cross-site scripting (XSS) vulnerability in RiteCMS 1.0.0 allows remote authenticated users to inject arbitrary web scri

23RISK

open ↗

Referência

CVE-2013-7194

CVE-2013-7194—

Multiple cross-site scripting (XSS) vulnerabilities in www/administrator.php in eFront 3.6.14 (build 18012) allow remote

23RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.