Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
26,494 exploits
Referência
CVE-2014-3738
CVE-2014-3738—
Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML
23RISK
open ↗
Referência
CVE-2009-4578
CVE-2009-4578—
Cross-site scripting (XSS) vulnerability in the Facileforms (com_facileforms) component for Joomla! and Mambo allows rem
23RISK
open ↗
Referência
CVE-2009-5137
CVE-2009-5137—
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
23RISK
open ↗
Referência✓ VexDay Proof
PHP Jokesite 2.0 - 'cat_id' SQL Injection
CVE-2008-2457—webappsphp
SQL injection vulnerability in jokes_category.php in PHP-Jokesite 2.0 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗
Referência
CVE-2010-5239
CVE-2010-5239—
Untrusted search path vulnerability in DAEMON Tools Lite 4.35.6.0091 and Pro Standard 4.36.0309.0160 allows local users
23RISK
open ↗
Referência✓ VexDay Proof
Brim 2.0.0 - SQL Injection / Cross-Site Scripting
CVE-2008-4082—webappsphp
SQL injection vulnerability in the Tasks plugin in Brim 2.0.0, when magic_quotes_gpc is disabled, allows remote authenti
23RISK
open ↗
Referência
CVE-2014-9610
CVE-2014-9610—
Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication an
23RISK
open ↗
Referência✓ VexDay Proof
Google Chrome - 'ChromeHTML://' Remote Parameter Injection
CVE-2008-5749—remotewindows
Argument injection vulnerability in Google Chrome 1.0.154.36 on Windows XP SP3 allows remote attackers to execute arbitr
23RISK
open ↗
Referência✓ VexDay Proof
Google Chrome 0.2.149.27 - Inspect Element Denial of Service
CVE-2008-6997—doswindows
Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG t
23RISK
open ↗
Referência
CVE-2018-14840
CVE-2018-14840—
uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for exam
23RISK
open ↗
Referência
CVE-2019-16173
CVE-2019-16173—
LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example,
23RISK
open ↗
Referência
CVE-2022-2841
CVE-2022-2841LOW
CrowdStrike Falcon Uninstallation authorization
28RISK
open ↗
Referência
CVE-2023-3848
CVE-2023-3848LOW
mooSocial mooDating URL view cross site scripting
43RISK
open ↗
Referência
CVE-2026-91996
CVE-2026-91996HIGH
lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
41RISK
open ↗
Referência
CVE-2021-21465
CVE-2021-21465CRITICAL
The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the b
48RISK
open ↗
Referência✓ VexDay Proof
@lex Guestbook 4.0.2 - Remote Command Execution
CVE-2007-0202—webappsphp
SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows
23RISK
open ↗
Referência✓ VexDay Proof
Microsoft Internet Explorer 7 - Memory Corruption (PoC) (MS09-002)
CVE-2009-0075—doswindows
Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows r
60RISK
open ↗
Referência
CVE-2013-1604
CVE-2013-1604—
Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
GuppY 4.5.16 - Remote Command Execution
CVE-2007-0639—webappsphp
Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject
23RISK
open ↗
Referência✓ VexDay Proof
EDraw Flowchart ActiveX Control 2.0 - Insecure Method
CVE-2007-5826—remotewindows
Absolute path traversal vulnerability in the EDraw Flowchart ActiveX control in EDImage.ocx 2.0.2005.1104 allows remote
23RISK
open ↗
Referência✓ VexDay Proof
bloofox 0.3 - SQL Injection / File Disclosure
CVE-2008-0427—webappsphp
Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a ..
23RISK
open ↗
Referência
CVE-2014-2340
CVE-2014-2340—
Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers
23RISK
open ↗
Referência✓ VexDay Proof
Acidcat CMS 3.4.1 - Multiple Vulnerabilities
CVE-2008-1993—webappsphp
Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary
23RISK
open ↗
Referência✓ VexDay Proof
Integramod 1.4.x - Insecure Directory Download Database
CVE-2008-4183—webappsphp
IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote a
23RISK
open ↗
Referência
CVE-2017-17612
CVE-2017-17612—
Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
23RISK
open ↗
Referência
CVE-2018-18308
CVE-2018-18308—
In the 4.2.23 version of BigTree, a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (ak
23RISK
open ↗
Referência
CVE-2018-5754
CVE-2018-5754—
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and
23RISK
open ↗
Referência
CVE-2018-6024
CVE-2018-6024—
SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.
23RISK
open ↗
Referência
CVE-2013-6976
CVE-2013-6976—
Cross-site request forgery (CSRF) vulnerability in goform/Quick_setup on Cisco EPC3925 devices allows remote attackers t
23RISK
open ↗
Referência
CVE-2023-3843
CVE-2023-3843LOW
mooSocial mooDating URL question cross site scripting
43RISK
open ↗
← previouspage 729 / 884next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.