Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits

39,953CVEs with public exploitation

24,696lab-tested

All Referência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecent popular risk

25,887 exploits

Referência✓ VexDay Proof

Fundanemt 2.2.0 - 'spellcheck.php' Remote Code Execution

CVE-2007-2935—webappsphp

core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via she

23RISK

open ↗

Referência✓ VexDay Proof

TikiWiki 1.9.8 - Remote PHP Injection

CVE-2007-5423—webappsphp

tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f ar

60RISK

open ↗

Referência

CVE-2017-11155

CVE-2017-11155—

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remot

35RISK

open ↗

Referência✓ VexDay Proof

PromoteWeb MySQL - 'id' SQL Injection

CVE-2008-5069—webappsphp

SQL injection vulnerability in go.php in Panuwat PromoteWeb MySQL, when magic_quotes_gpc is disabled, allows remote atta

23RISK

open ↗

Referência✓ VexDay Proof

Tutti Nova 1.6 - 'TNLIB_DIR' Remote File Inclusion

CVE-2006-4276—webappsphp

PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP c

23RISK

open ↗

Referência✓ VexDay Proof

Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion

CVE-2008-5762—webappsphp

Simple Text-File Login Script (SiTeFiLo) 1.0.6 stores sensitive information under the web root with insufficient access

23RISK

open ↗

Referência✓ VexDay Proof

SportsPHool 1.0 - 'mainnav' Remote File Inclusion

CVE-2006-4278—webappsphp

PHP remote file inclusion vulnerability in includes/layout/plain.footer.php in SportsPHool 1.0 allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

LBlog 1.05 - 'comments.asp' SQL Injection

CVE-2006-4284—webappsasp

SQL injection vulnerability in comments.asp in LBlog 1.05 and earlier allows remote attackers to execute arbitrary SQL c

23RISK

open ↗

Referência✓ VexDay Proof

Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion

CVE-2008-5763—webappsphp

PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows r

35RISK

open ↗

Referência✓ VexDay Proof

FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion

CVE-2006-7107—webappsphp

PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to ex

23RISK

open ↗

Referência✓ VexDay Proof

Gnews Publisher .NET - SQL Injection

CVE-2008-5767—webappsasp

SQL injection vulnerability in authors.asp in gNews Publisher allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência✓ VexDay Proof

MDPro 1.0.76 - 'Cookie PNSVlang' Local File Inclusion

CVE-2006-7112—webappsphp

Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read an

23RISK

open ↗

Referência✓ VexDay Proof

Opera 9.64 - 7400 nested elements XML Parsing Remote Crash

CVE-2009-1234—dosmultiple

Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a lon

23RISK

open ↗

Referência✓ VexDay Proof

Apple Mac OSX xnu 1228.3.13 - 'Profil' Kernel Memory Leak/Denial of Service (PoC)

CVE-2009-1237—dososx

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a den

23RISK

open ↗

Referência

CVE-2013-1080

CVE-2013-1080—

The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform a

60RISK

open ↗

Referência

CVE-2013-2251

CVE-2013-2251CRITICALunder attack

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a

100RISK

open ↗

Referência

CVE-2015-5539

CVE-2015-5539—

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linu

35RISK

open ↗

Referência

CVE-2016-3301

CVE-2016-3301—

The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

35RISK

open ↗

Referência

CVE-2018-15710

CVE-2018-15710—

Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.

50RISK

open ↗

Referência

CVE-2018-6317

CVE-2018-6317—

The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format strin

50RISK

open ↗

Referência✓ VexDay Proof

Joomla! Component Feederator 1.0.5 - Multiple Remote File Inclusions

CVE-2008-5789—webappsphp

Multiple PHP remote file inclusion vulnerabilities in the Recly Interactive Feederator (com_feederator) component 1.0.5

35RISK

open ↗

Referência✓ VexDay Proof

Fantastic News 2.1.3 - 'script_path' Remote File Inclusion

CVE-2006-4285—webappsphp

PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

GuestCal 2.1 - 'index.php?lang' Local File Inclusion

CVE-2009-1319—webappsphp

Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute

23RISK

open ↗

Referência

CVE-2021-3493

CVE-2021-3493HIGHunder attack

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISK

open ↗

Referência

CVE-2021-3493

CVE-2021-3493HIGHunder attack

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISK

open ↗

Referência

CVE-2021-3493

CVE-2021-3493HIGHunder attack

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISK

open ↗

Referência

CVE-2022-31188

CVE-2022-31188HIGH

Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)

53RISK

open ↗

Referência

CVE-2020-10882

CVE-2020-10882HIGH

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arch

68RISK

open ↗

Referência

CVE-2023-24709

CVE-2023-24709HIGH

An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and l

53RISK

open ↗

Referência

CVE-2022-3552

CVE-2022-3552HIGH

Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling

53RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.