Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,526cataloged exploits
34,478CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Geeklog < 1.4.0 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attacke
23RISK
open ↗Exploit-DB
ADOdb < 4.71 - Cross Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - LoadVars.decode Use-After-Free
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - BitmapData.drawWithQuality Heap Overflow
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Out-of-Bounds Image Read
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - H264 File Stack Corruption
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - ATF Processing Heap Overflow
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - Sound.loadPCMFromByteArray Dangling Pointer
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and
83RISK
open ↗Exploit-DB
Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive informat
60RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash - textfield Constructor Type Confusion
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on
28RISK
open ↗Exploit-DB✓ VexDay Proof
glibc - 'getaddrinfo' Stack Buffer Overflow (PoC)
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
45RISK
open ↗Exploit-DB
Flash ActiveX 28.0.0.137 - Code Execution (1)
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISK
open ↗Exploit-DB
Microsoft Windows 7 (x86) - 'afd.sys' Dangling Pointer Privilege Escalation (MS14-040)
Double free vulnerability in the Ancillary Function Driver (AFD) in afd.sys in the kernel-mode drivers in Microsoft Wind
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Kerberos Security Feature Bypass (MS16-014)
Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
28RISK
open ↗Exploit-DB
Flash ActiveX 28.0.0.137 - Code Execution (2)
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISK
open ↗Exploit-DB
Yeager CMS 1.2.1 - Multiple Vulnerabilities
SQL injection vulnerability in "yeager/y.php/tab_USERLIST" in Yeager CMS 1.2.1 allows local users to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Sling Framework (Adobe AEM) 2.3.6 - Information Disclosure
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
35RISK
open ↗Exploit-DB
Yeager CMS 1.2.1 - Multiple Vulnerabilities
Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS 1.2.1 allow remote attackers to trigger outbou
23RISK
open ↗Exploit-DB
Yeager CMS 1.2.1 - Multiple Vulnerabilities
Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploadin
23RISK
open ↗Exploit-DB
Yeager CMS 1.2.1 - Multiple Vulnerabilities
SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passw
23RISK
open ↗Exploit-DB
Yeager CMS 1.2.1 - Multiple Vulnerabilities
SQL injection vulnerability in the password recovery feature in Yeager CMS 1.2.1 allows remote attackers to change the a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 7 SP1 (x86) - 'WebDAV' Local Privilege Escalation (MS16-016) (1)
The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window
43RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Photoshop CC / Bridge CC - '.png' Parsing Memory Corruption (1)
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Photoshop CC / Bridge CC - '.iff' Parsing Memory Corruption
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Photoshop CC / Bridge CC - '.png' Parsing Memory Corruption (2)
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to exec
28RISK
open ↗Exploit-DB
D-Link DVGN5402SP - Multiple Vulnerabilities
Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remot
50RISK
open ↗Exploit-DB
D-Link DVGN5402SP - Multiple Vulnerabilities
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root accou
28RISK
open ↗Exploit-DB
Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗Exploit-DB✓ VexDay Proof
GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authentica
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.