Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,542cataloged exploits
34,971CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,947VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,468✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
Microsoft Movie Maker - Remote Code Execution (MS10-016)
Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
NuSOAP 0.9.5 - 'nusoap.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
CMS WebManager-Pro - 'c.php' SQL Injection
SQL injection vulnerability in c.php in CMS WebManager-Pro before 8.1 allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime FlashPix NumberOfTiles - Remote Code Execution
Integer overflow in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause
23RISK
open ↗Exploit-DB✓ VexDay Proof
OneCMS 2.6.1 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in OneCMS 2.6.1 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB
dompdf 0.6.0 beta1 - Remote File Inclusion
PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Acrobat Reader and Flash Player - 'newclass' Invalid Pointer
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrob
100RISK
open ↗Exploit-DB✓ VexDay Proof
HP Insight Diagnostics Online Edition 8.4 - 'idstatusframe.php' Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP Insight Diagnostics Online Edition 8.4 - 'parameters.php?device' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP Insight Diagnostics Online Edition 8.4 - 'custom.php?testmode' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
mBlogger 1.0.04 - 'viewpost.php' SQL Injection
SQL injection vulnerability in viewpost.php in mBlogger 1.0.04 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP Insight Diagnostics Online Edition 8.4 - 'survey.php?category' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component JE FAQ Pro 1.5.0 - Multiple Blind SQL Injections
Multiple SQL injection vulnerabilities in the JE FAQ Pro (com_jefaqpro) component 1.5.0 for Joomla! allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP Insight Diagnostics Online Edition 8.4 - 'globals.php?tabpage' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Plug and Play Service - Overflow (MS05-039) (Metasploit)
Stack-based buffer overflow in the Plug and Play (PnP) service for Microsoft Windows 2000 and Windows XP Service Pack 1
60RISK
open ↗Exploit-DB
seagull 0.6.7 - Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Seagull 0.6.7 allow remote attackers to execute arbitrary PHP code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component PicSell 1.0 - Local File Disclosure
Directory traversal vulnerability in the PicSell (com_picsell) component 1.0 for Joomla! allows remote attackers to read
38RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime - '_Marshaled_pUnk' Backdoor Client-Side Arbitrary Code Execution
The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions all
50RISK
open ↗Exploit-DB✓ VexDay Proof
Nginx 0.6.38 - Heap Corruption
Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, a
45RISK
open ↗Exploit-DB
Multi-lingual E-Commerce System 0.2 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Multi-lingual E-Commerce System 0.2 allow remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Seagull 0.6.7 - SQL Injection
SQL injection vulnerability in index.php in Seagull 0.6.7 and earlier allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
GaleriaSHQIP 1.0 - SQL Injection
SQL injection vulnerability in index.php in GaleriaSHQIP 1.0, when magic_quotes_gpc is disabled, allows remote attackers
23RISK
open ↗Exploit-DB
DIY-CMS 1.0 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in DiY-CMS 1.0 allow remote attackers to execute arbitrary PHP code v
23RISK
open ↗Exploit-DB
textpattern CMS 4.2.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
XOOPS 2.0.14 - 'article.php' SQL Injection
SQL injection vulnerability in article.php in the Article module for XOOPS allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel < 2.6.36-rc1 (Ubuntu 10.04 / 2.6.32) - 'CAN BCM' Local Privilege Escalation
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.
23RISK
open ↗Exploit-DB✓ VexDay Proof
iGaming CMS - Multiple SQL Injections
Multiple SQL injection vulnerabilities in iGaming 1.5 and earlier allow remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB
pecio CMS 2.0.5 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP co
23RISK
open ↗Exploit-DB✓ VexDay Proof
EncFS 1.6.0 - Flawed CBC/CFB Cryptography Implementation
SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gaestebuch 1.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in guestbook/gbook.php in Gaestebuch 1.2 allows remote attackers to execute arbi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.