Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,386cataloged exploits
36,533CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,104GitHub PoC 15,075VulnCheck XDB 8,883Nuclei 4,365Metasploit 3,493✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Unreal Tournament 2004 (Linux) - 'secure' Remote Overflow (Metasploit)
The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier,
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX Software Update - Command Execution (Metasploit)
Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (
43RISK
open ↗Exploit-DB✓ VexDay Proof
Java 6.19 CMM readMabCurveData - Remote Stack Overflow
Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - Data Binding Memory Corruption (MS08-078) (Metasploit)
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet
50RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe CoolType - SING Table 'uniqueName' Remote Stack Buffer Overflow (Metasploit) (1)
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
LightNEasy CMS 3.2.1 - Blind SQL Injection
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
TikiWiki tiki-graph_formula - PHP Remote Code Execution (Metasploit)
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f ar
60RISK
open ↗Exploit-DB✓ VexDay Proof
Ultra Shareware Office Control - ActiveX HttpUpload Buffer Overflow (Metasploit)
Stack-based buffer overflow in the Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 in Ultra Shareware
50RISK
open ↗Exploit-DB✓ VexDay Proof
AppleFileServer (OSX) - LoginExt PathName Overflow (Metasploit)
Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitr
50RISK
open ↗Exploit-DB✓ VexDay Proof
Racer 0.5.3 Beta 5 - Remote Buffer Overflow (Metasploit)
Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbit
50RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java - JRE AWT setDiffICM Buffer Overflow (Metasploit)
Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS - ISAPI RSA WebAgent Redirect Overflow (Metasploit)
Stack-based buffer overflow in IISWebAgentIF.dll in RSA Authentication Agent for Web (aka SecurID Web Agent) 5.2 and 5.3
50RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java JRE - getSoundbank 'file://' URI Buffer Overflow (Metasploit)
Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, J
60RISK
open ↗Exploit-DB✓ VexDay Proof
TinyIdentD 2.2 - Remote Stack Buffer Overflow (Metasploit)
Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long s
50RISK
open ↗Exploit-DB✓ VexDay Proof
QBik WinGate WWW Proxy Server - URL Processing Overflow (Metasploit)
Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial
60RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (1)
Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might all
50RISK
open ↗Exploit-DB✓ VexDay Proof
HP - 'OmniInet.exe' MSG_PROTOCOL Buffer Overflow (Metasploit) (2)
Stack-based buffer overflow in OmniInet.exe (aka the backup client service daemon) in the Application Recovery Manager c
50RISK
open ↗Exploit-DB✓ VexDay Proof
iPhone MobileMail - LibTIFF Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and othe
50RISK
open ↗Exploit-DB✓ VexDay Proof
Computer Associates License Client - GETCONFIG Overflow (Metasploit)
Multiple buffer overflows in Computer Associates (CA) License Client and Server 0.1.0.15 allow remote attackers to execu
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook - 'ATTACH_BY_REF_ONLY' File Execution (MS10-045) (Metasploit)
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_
50RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris LPD - Command Execution (Metasploit)
lpd daemon (in.lpd) in Solaris 8 and earlier allows remote attackers to execute arbitrary commands via a job request wit
60RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 9i XDB (Windows x86) - HTTP PASS Overflow (Metasploit)
Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Private Communications Transport - Remote Overflow (MS04-011) (Metasploit)
Buffer overflow in the Private Communications Transport (PCT) protocol implementation in the Microsoft SSL library, as u
60RISK
open ↗Exploit-DB✓ VexDay Proof
Lyris ListManager - MSDE Weak sa Password (Metasploit)
The MSDE version of Lyris ListManager 5.0 through 8.9b configures the sa account in the database to use a password with
50RISK
open ↗Exploit-DB✓ VexDay Proof
IBM TPM for OS Deployment 5.1.0.x - 'rembo.exe' Remote Buffer Overflow (Metasploit)
The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly hand
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)
Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attack
60RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Domino Web Access Upload Module - Remote Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, in
50RISK
open ↗Exploit-DB✓ VexDay Proof
IPSwitch IMail IMAP4D - Delete Overflow (Metasploit)
Stack-based buffer overflow in IPSwitch IMail 8.13 allows remote authenticated users to execute arbitrary code via a lon
60RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4 - Unserialize() ZVAL Reference Counter Overflow (Cookie) (Metasploit)
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long
50RISK
open ↗Exploit-DB✓ VexDay Proof
Apple iPhone MobileSafari LibTIFF - 'email' Remote Buffer Overflow (Metasploit) (2)
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and othe
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.