Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,386cataloged exploits
36,533CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,104GitHub PoC 15,075VulnCheck XDB 8,883Nuclei 4,365Metasploit 3,493✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
McAfee ePolicy Orchestrator / ProtectionPilot - Remote Overflow (Metasploit)
Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attac
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - location.QueryInterface() Code Execution (Metasploit)
Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attac
60RISK
open ↗Exploit-DB✓ VexDay Proof
McAfee Visual Trace - ActiveX Control Buffer Overflow (Metasploit)
Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Ex
50RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Suite/Firefox - Navigator Object Code Execution (Metasploit)
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by chang
60RISK
open ↗Exploit-DB✓ VexDay Proof
PeerCast 0.1216 (Linux) - URL Handling Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in the procConnectArgs function in servmgr.cpp in PeerCast before 0.1217 allow rem
60RISK
open ↗Exploit-DB✓ VexDay Proof
LightNEasy CMS 3.2.1 - Blind SQL Injection
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP - 'OmniInet.exe' MSG_PROTOCOL Buffer Overflow (Metasploit) (2)
Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager c
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft WINS - Service Memory Overwrite (MS04-045) (Metasploit)
The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remo
60RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 9i XDB (Windows x86) - HTTP PASS Overflow (Metasploit)
Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to
50RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe - FlateDecode Stream Predictor 02 Integer Overflow (Metasploit) (1)
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows rem
100RISK
open ↗Exploit-DB✓ VexDay Proof
IBM TPM for OS Deployment 5.1.0.x - 'rembo.exe' Remote Buffer Overflow (Metasploit)
The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly hand
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook - 'ATTACH_BY_REF_RESOLVE' File Execution (MS10-045) (Metasploit)
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_
50RISK
open ↗Exploit-DB✓ VexDay Proof
TikiWiki tiki-graph_formula - PHP Remote Code Execution (Metasploit)
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f ar
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX Software Update - Command Execution (Metasploit)
Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (
43RISK
open ↗Exploit-DB✓ VexDay Proof
Lyris ListManager - MSDE Weak sa Password (Metasploit)
The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with
50RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX NewObject Method Buffer Overflow (Metasploit)
Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Help Center - Cross-Site Scripting / Command Execution (MS10-042) (Metasploit)
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Private Communications Transport - Remote Overflow (MS04-011) (Metasploit)
Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as u
60RISK
open ↗Exploit-DB✓ VexDay Proof
eIQNetworks ESA - Topology DELETEDEVICE Overflow (Metasploit)
Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in product
60RISK
open ↗Exploit-DB✓ VexDay Proof
Arugizer Trojan Horse (Energizer DUO) - Code Execution (Metasploit)
UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Aru
43RISK
open ↗Exploit-DB✓ VexDay Proof
OpenX - 'banner-edit.php' Arbitrary File Upload / PHP Code Execution (Metasploit)
Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticate
43RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - COM CreateObject Code Execution (MS06-014/MS06-073) (Metasploit)
Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and dis
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit)
Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause
50RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java - Calendar Deserialization (Metasploit)
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; a
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apple iPhone MobileSafari LibTIFF - 'browser' Remote Buffer Overflow (Metasploit) (1)
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and othe
50RISK
open ↗Exploit-DB✓ VexDay Proof
Snapshot Viewer for Microsoft Access - ActiveX Control Arbitrary File Download (Metasploit)
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snaps
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - COM CreateObject Code Execution (MS06-014/MS06-073) (Metasploit)
Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScript
50RISK
open ↗Exploit-DB✓ VexDay Proof
LightNEasy CMS 3.2.1 - Blind SQL Injection
SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote auth
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (1)
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrob
100RISK
open ↗Exploit-DB✓ VexDay Proof
TinyIdentD 2.2 - Remote Stack Buffer Overflow (Metasploit)
Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long s
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.