Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,902cataloged exploits
34,597CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Adobe ColdFusion 9 - Administrative Authentication Bypass
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
100RISK
open ↗Exploit-DB
Samsung DVR Firmware 1.10 - Authentication Bypass
Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to
28RISK
open ↗Exploit-DB✓ VexDay Proof
Xibo - 'layout' HTML Injection
Cross-site scripting (XSS) vulnerability in index.php in Digital Signage Xibo 1.4.2 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Twilight CMS - DeWeS Web Server Directory Traversal
Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Graphite Web - Unsafe Pickle Handling (Metasploit)
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
50RISK
open ↗Exploit-DB
Samsung DVR Firmware 1.10 - Authentication Bypass
Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID v
28RISK
open ↗Exploit-DB✓ VexDay Proof
Java - 'storeImageArray()' Invalid Array Indexing (Metasploit)
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 U
100RISK
open ↗Exploit-DB✓ VexDay Proof
PCMan FTP Server 2.07 - 'STOR' Remote Buffer Overflow
Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USE
50RISK
open ↗Exploit-DB
IBM 1754 GCM 1.18.0.22011 - Remote Command Execution
ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avoce
23RISK
open ↗Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player 2.0.8 - '.m3u' Local Crash (PoC)
VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
AlgoSec Firewall Analyzer - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
DotNetNuke DNNArticle Module 10.0 - SQL Injection
SQL injection vulnerability in the RSS page (DNNArticleRSS.aspx) in the ZLDNN DNNArticle module before 10.1 for DotNetNu
23RISK
open ↗Exploit-DB
KCFinder 2.51 - Local File Disclosure
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ultra Mini HTTPd - Remote Stack Buffer Overflow (Metasploit)
Stack-based buffer overflow in Ultra Mini HTTPD 1.21 allows remote attackers to execute arbitrary code via a long resour
50RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Media Manager - Arbitrary File Upload (Metasploit)
administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before
50RISK
open ↗Exploit-DB✓ VexDay Proof
Chasys Draw IES - Local Buffer Overflow (Metasploit)
Stack-based buffer overflow in the ReadFile function in flt_BMP.dll in Chasys Draw IES before 4.11.02 allows remote atta
50RISK
open ↗Exploit-DB✓ VexDay Proof
HP StorageWorks P4000 Virtual SAN Appliance - Login Buffer Overflow (Metasploit)
Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attacke
28RISK
open ↗Exploit-DB✓ VexDay Proof
HP StorageWorks P4000 Virtual SAN Appliance - Login Buffer Overflow (Metasploit)
Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attacke
50RISK
open ↗Exploit-DB✓ VexDay Proof
Open-FTPD 1.2 - Arbitrary File Upload (Metasploit)
Open&Compact FTP Server (Open-FTPD) 1.2 and earlier allows remote attackers to bypass authentication by sending (1) LIST
43RISK
open ↗Exploit-DB
Joomla! Component redSHOP 1.2 - SQL Injection
SQL injection vulnerability in the redSHOP Component (com_redshop) 1.0 for Joomla! allows remote attackers to execute ar
23RISK
open ↗Exploit-DB
Gnew 2013.1 - Multiple Vulnerabilities (1)
Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Hms Testimonials 2.0.10 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPVID 1.2.3 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, an
60RISK
open ↗Exploit-DB
Gnew 2013.1 - Multiple Vulnerabilities (1)
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Hms Testimonials 2.0.10 - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress al
23RISK
open ↗Exploit-DB✓ VexDay Proof
OpenX - Backdoor PHP Code Execution (Metasploit)
A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, wh
60RISK
open ↗Exploit-DB
Gnew 2013.1 - Multiple Vulnerabilities (1)
Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPVID 1.2.3 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in search_results.php in Vastal I-Tech phpVID 1.1 and 1.2 allows remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPVID 1.2.3 - Multiple Vulnerabilities
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.