Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
MySQL / MariaDB / PerconaDB 5.5.51/5.6.32/5.7.14 - Code Execution / Privilege Escalation
Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.2
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Transform.colorTranform Getter Infomation Leak
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
35RISK
open ↗Exploit-DB✓ VexDay Proof
Google Android - libutils UTF16 to UTF8 Conversion Heap Buffer Overflow
LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Method Calls Use-After-Free
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe ColdFusion < 11 Update 10 - XML External Entity Injection
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attack
35RISK
open ↗Exploit-DB
glibc - 'getaddrinfo' Remote Stack Buffer Overflow
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
45RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - BitmapData.copyPixels Use-After-Free
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Selection.setFocus Use-After-Free
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - MovieClip Transform Getter Use-After-Free
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Use-After-Free When Returning Rectangle
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Stage.align Setter Use-After-Free
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows
35RISK
open ↗Exploit-DB
CubeCart < 3.0.12 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in CubeCart 3.0.12 and earlier, when register_globals is enabled, allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Eye of Gnome 3.10.2 - GMarkup Out of Bounds Write
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib befor
28RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 4.5.3 - Directory Traversal / Denial of Service
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.
43RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 4.5.3 - Directory Traversal / Denial of Service
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPre
35RISK
open ↗Exploit-DB✓ VexDay Proof
Ocomon 2.0 - SQL Injection
SQL injection vulnerability in OcoMon 1.21, and possibly other versions, when magic_quotes_gpc is disabled, allows remot
23RISK
open ↗Exploit-DB
Fortigate Firewalls - 'EGREGIOUSBLUNDER' Remote Code Execution
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
35RISK
open ↗Exploit-DB
Cisco ASA / PIX - 'EPICBANANA' Local Privilege Escalation
Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows loc
76RISK
open ↗Exploit-DB
Watchguard Firewalls - 'ESCALATEPLOWMAN' ifconfig Privilege Escalation
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
23RISK
open ↗Exploit-DB
Linux Kernel - TCP Related Read Use-After-Free
The tcp_check_send_head function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certai
23RISK
open ↗Exploit-DB
Cisco ASA 8.x - 'EXTRABACON' Authentication Bypass
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Service
100RISK
open ↗Exploit-DB
X-Cart < 4.1.3 - Arbitrary Variable Overwrite
Dynamic variable evaluation vulnerability in cmpi.php in Qualiteam X-Cart 4.1.3 and earlier allows remote attackers to o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - GDI+ DecodeCompressedRLEBitmap Invalid Pointer Arithmetic Out-of-Bounds Write (MS16-097)
The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - GDI+ EMR_EXTTEXTOUTA / EMR_POLYTEXTOUTA Heap Buffer Overflow (MS16-097)
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - GDI+ ValidateBitmapInfo Invalid Pointer Arithmetic Out-of-Bounds Reads (MS16-097)
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007
35RISK
open ↗Exploit-DB✓ VexDay Proof
WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Word 2013/2016 - sprmSdyaTop Denial of Service (MS16-099)
Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a craf
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - MSHTML!CMultiReadStreamLifetimeManager::ReleaseThreadStateInternal Read AV
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet E
35RISK
open ↗Exploit-DB✓ VexDay Proof
WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH
23RISK
open ↗Exploit-DB✓ VexDay Proof
WSO2 Carbon 4.4.5 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.