Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits

40,695CVEs with public exploitation

24,696lab-tested

All Referência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecent popular risk

26,327 exploits

Referência

CVE-2019-19731

CVE-2019-19731—

Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary loc

28RISK

open ↗

Referência

CVE-2019-9189

CVE-2019-9189—

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when

28RISK

open ↗

Referência

CVE-2014-3976

CVE-2014-3976—

Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allow

28RISK

open ↗

Referência✓ VexDay Proof

RSS Simple News - SQL Injection

CVE-2008-6333—webappsphp

SQL injection vulnerability in news.php in RSS Simple News (RSSSN), when magic_quotes_gpc is disabled, allows remote att

23RISK

open ↗

Referência

CVE-2010-1957

CVE-2010-1957—

Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attack

43RISK

open ↗

Referência

CVE-2010-2847

CVE-2010-2847—

Multiple SQL injection vulnerabilities in the InterJoomla ArtForms (com_artforms) component 2.1b7.2 RC2 for Joomla! allo

23RISK

open ↗

Referência

CVE-2013-3502

CVE-2013-3502—

monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to ex

50RISK

open ↗

Referência

CVE-2014-3976

CVE-2014-3976—

Buffer overflow in A10 Networks Advanced Core Operating System (ACOS) before 2.7.0-p6 and 2.7.1 before 2.7.1-P1_55 allow

28RISK

open ↗

Referência

CVE-2018-12453

CVE-2018-12453—

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers t

28RISK

open ↗

Referência

CVE-2005-2616

CVE-2005-2616—

Multiple PHP file include vulnerabilities in ezUpload 2.2 allow remote attackers to execute arbitrary code via the path

28RISK

open ↗

Referência

CVE-2016-5725

CVE-2016-5725—

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allow

28RISK

open ↗

Referência

CVE-2014-9147

CVE-2014-9147—

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup fil

28RISK

open ↗

Referência✓ VexDay Proof

NewsReactor 20070220 - Article Grabbing Remote Buffer Overflow (2)

CVE-2007-1568—remotewindows

Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via

23RISK

open ↗

Referência✓ VexDay Proof

Cisco Phone 7940 - Remote Denial of Service

CVE-2007-5583—doshardware

Cisco IP Phone 7940 with firmware P0S3-08-7-00 allows remote attackers to cause a denial of service ("486 Busy" response

23RISK

open ↗

Referência

CVE-2018-18428

CVE-2018-18428—

TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg

28RISK

open ↗

Referência

CVE-2019-6274

CVE-2019-6274—

Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote atta

28RISK

open ↗

Referência

CVE-2019-10009

CVE-2019-10009—

A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated use

28RISK

open ↗

Referência

CVE-2019-10009

CVE-2019-10009—

A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated use

28RISK

open ↗

Referência

CVE-2019-6274

CVE-2019-6274—

Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote atta

28RISK

open ↗

Referência

CVE-2021-3337

CVE-2021-3337—

The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading re

28RISK

open ↗

Referência✓ VexDay Proof

Socketmail 2.2.8 - 'fnc-readmail3.php' Remote File Inclusion

CVE-2007-5627—webappsphp

PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to exec

23RISK

open ↗

Referência

CVE-2013-1605

CVE-2013-1605—

Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitra

28RISK

open ↗

Referência✓ VexDay Proof

SolarCMS 0.53.8 - 'Forum' Remote Cookies Disclosure

CVE-2008-6345—webappsphp

SQL injection vulnerability in Forum.php in SolarCMS 0.53.8 and 1.0 allows remote attackers to execute arbitrary SQL com

23RISK

open ↗

Referência

CVE-2010-1878

CVE-2010-1878—

Directory traversal vulnerability in the OrgChart (com_orgchart) component 1.0.0 for Joomla! allows remote attackers to

43RISK

open ↗

Referência

CVE-2010-2133

CVE-2010-2133—

SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2010-2916

CVE-2010-2916—

SQL injection vulnerability in news.php in AJ Square AJ HYIP MERIDIAN allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência

CVE-2014-9147

CVE-2014-9147—

Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup fil

28RISK

open ↗

Referência✓ VexDay Proof

scWiki 1.0 Beta 2 - 'common.php?pathdot' Remote File Inclusion

CVE-2007-5843—webappsphp

PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute a

35RISK

open ↗

Referência

CVE-2017-9430

CVE-2017-9430—

Stack-based buffer overflow in dnstracer through 1.9 allows attackers to cause a denial of service (application crash) o

28RISK

open ↗

Referência

CVE-2007-2583

CVE-2007-2583—

The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-depen

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.