Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Kasseler CMS - File Disclosure / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
AWScripts Gallery Search Engine 1.x - Insecure Cookie
The admin interface in AWScripts.com Gallery Search Engine 1.5 allows remote attackers to bypass authentication and gain
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyBB 1.4.6 - Remote Code Execution
SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authen
23RISK
open ↗Exploit-DB✓ VexDay Proof
MIDAS 1.43 - (Authentication Bypass) Insecure Cookie Handling
MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bopup Communications Server 3.2.26.5460 - Remote SYSTEM
Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrar
50RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyAdmin - 'pmaPWN!' Code Injection / Remote Code Execution
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remo
100RISK
open ↗Exploit-DB✓ VexDay Proof
Kasseler CMS - File Disclosure / Cross-Site Scripting
Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.11 and Thunderbird 2.0.9 - RDF File Handling Remote Memory Corruption
The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and
28RISK
open ↗Exploit-DB✓ VexDay Proof
Programs Rating - 'postcomments.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Programs Rating - 'rate.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Programs Rating Script allow remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Edraw PDF Viewer Component < 3.2.0.126 - ActiveX Insecure Method
Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Compo
23RISK
open ↗Exploit-DB✓ VexDay Proof
DESlock+ 4.0.2 - 'dlpcrypt.sys' Local Kernel Ring0 Code Execution
The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80
23RISK
open ↗Exploit-DB✓ VexDay Proof
Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC)
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
iDefense COMRaider - ActiveX Control Multiple Insecure Method Vulnerabilities
Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.30 - 'tun_chr_pool()' Null Pointer Dereference
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -f
23RISK
open ↗Exploit-DB✓ VexDay Proof
formmail 1.92 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, a
23RISK
open ↗Exploit-DB✓ VexDay Proof
SugarCRM 5.2.0e - Remote Code Execution
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka
28RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear DG632 Router - Authentication Bypass
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentic
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear DG632 Router - Authentication Bypass
Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmwar
23RISK
open ↗Exploit-DB✓ VexDay Proof
formmail 1.92 - Multiple Vulnerabilities
CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear DG632 Router - Remote Denial of Service
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 9i/10g Database - Network Foundation Remote Overflow
Unspecified vulnerability in the Network Foundation component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4,
28RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 9i/10g Database - TNS Command Remote Denial of Service
Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.
28RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 9i/10g Database - Remote Network Authentication
Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.
28RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle WebLogic Server 10.3 - 'console-help.portal' Cross-Site Scripting
Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 11.1 - Database Network Foundation Heap Memory Corruption
Unspecified vulnerability in the Network Foundation component in Oracle Database 11.1.0.6 allows remote authenticated us
23RISK
open ↗Exploit-DB✓ VexDay Proof
Scriptsez Easy Image Downloader - 'id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 10g Secure Enterprise Search - 'search_p_groups' Cross-Site Scripting
Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers
35RISK
open ↗Exploit-DB✓ VexDay Proof
HP ProCurve Threat Management Services - zl ST.1.0.090213 Module CRL Security Bypass
Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
4Images 1.7.7 - Filter Bypass HTML Injection / Cross-Site Scripting
Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic_quotes_gpc is disabled, allows remot
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.