Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
25,887 exploits
Referência✓ VexDay Proof
MW6 PDF417 - ActiveX 'MW6PDF417.dll' Remote Insecure Method
CVE-2008-4926—remotewindows
Multiple insecure method vulnerabilities in MW6 Technologies PDF417 ActiveX control (MW6PDF417Lib.PDF417, MW6PDF417.dll)
23RISK
open ↗
Referência
CVE-2015-1487
CVE-2015-1487—
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticat
50RISK
open ↗
Referência✓ VexDay Proof
phpPrintAnalyzer 1.2 - Remote File Inclusion
CVE-2006-4164—webappsphp
PHP remote file inclusion vulnerability in inc/header.inc.php in phpPrintAnalyzer 1.2 and earlier allows remote attacker
23RISK
open ↗
Referência✓ VexDay Proof
Product Sale Framework 0.1b - SQL Injection
CVE-2008-5590—webappsphp
SQL injection vulnerability in customer.forumtopic.php in Kalptaru Infotech Product Sale Framework 0.1 beta allows remot
23RISK
open ↗
Referência
CVE-2008-5595
CVE-2008-5595—
SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗
Referência✓ VexDay Proof
Tribiq CMS 5.0.9a (Beta) - Insecure Cookie Handling
CVE-2008-6804—webappsphp
Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the CO
23RISK
open ↗
Referência✓ VexDay Proof
OneOrZero Helpdesk 1.6.5.7 - Local File Inclusion
CVE-2009-0886—webappsphp
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read
23RISK
open ↗
Referência✓ VexDay Proof
Apple iTunes 8.1.1.10 (Windows) - 'itms/itcp' Remote Buffer Overflow
CVE-2009-0950—remotewindows
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a deni
43RISK
open ↗
Referência✓ VexDay Proof
RhinoSoft Serv-U FTP Server 7.4.0.1 - 'SMNT' (Authenticated) Denial of Service
CVE-2009-0967—doswindows
The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service
23RISK
open ↗
Referência
CVE-2009-3195
CVE-2009-3195—
Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to
23RISK
open ↗
Referência
CVE-2016-3316
CVE-2016-3316—
Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a craf
35RISK
open ↗
Referência
CVE-2020-10914
CVE-2020-10914CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.
75RISK
open ↗
Referência
CVE-2023-30258
CVE-2023-30258CRITICAL
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISK
open ↗
Referência
CVE-2014-0282
CVE-2014-0282—
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service
35RISK
open ↗
Referência
CVE-2008-5037
CVE-2008-5037—
SQL injection vulnerability in view.php in ElkaGroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL
23RISK
open ↗
Referência
CVE-2015-6127
CVE-2015-6127—
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers t
50RISK
open ↗
Referência
CVE-2018-8736
CVE-2018-8736—
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RC
50RISK
open ↗
Referência
CVE-2009-3645
CVE-2009-3645—
SQL injection vulnerability in the JoomlaCache CB Resume Builder (com_cbresumebuilder) component for Joomla! allows remo
23RISK
open ↗
Referência
CVE-2017-0084
CVE-2017-0084—
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
35RISK
open ↗
Referência
CVE-2019-15984
CVE-2019-15984HIGH
Cisco Data Center Network Manager SQL Injection Vulnerabilities
53RISK
open ↗
Referência
CVE-2017-7615
CVE-2017-7615—
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value
60RISK
open ↗
Referência
CVE-2021-39608
CVE-2021-39608—
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a rem
35RISK
open ↗
Referência
CVE-2018-8736
CVE-2018-8736—
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RC
50RISK
open ↗
Referência
CVE-2010-2590
CVE-2010-2590—
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753
50RISK
open ↗
Referência✓ VexDay Proof
Merlix Teamworx Server - File Disclosure/Bypass
CVE-2008-5600—webappsphp
Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows re
23RISK
open ↗
Referência
CVE-2011-0096
CVE-2011-0096MEDIUM
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Wind
45RISK
open ↗
Referência
CVE-2011-3368
CVE-2011-3368—
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does
60RISK
open ↗
Referência✓ VexDay Proof
Spidey Blog Script 1.5 - 'proje_goster.asp' SQL Injection (1)
CVE-2006-4202—webappsasp
SQL injection vulnerability in proje_goster.php in Spidey Blog Script 1.5 and earlier allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
SFS EZ Link Directory - 'cat_id' SQL Injection
CVE-2008-6808—webappsphp
SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute
23RISK
open ↗
Referência✓ VexDay Proof
RhinoSoft Serv-U FTP Server 7.4.0.1 - 'MKD' Create Arbitrary Directories
CVE-2009-1031—remotewindows
Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows
28RISK
open ↗
← previouspage 87 / 863next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.