Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Apple Safari 3.2.2 - 'feed:' URI Multiple Input Validation Vulnerabilities
CVE-2009-0162—remotemultiple12 May 2009
Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CastRipper 2.50.70 - '.pls' Universal Stack Overflow
CVE-2009-5137—localwindows12 May 2009
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MPLAB IDE 8.30 - '.mcp' Universal Overwrite (SEH)
CVE-2009-1608—localwindows11 May 2009
Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing
CVE-2009-1834—remotelinux11 May 2009
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey befor
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.10 - 'nsViewManager.cpp' Denial of Service
CVE-2009-2043—doslinux11 May 2009
nsViewManager.cpp in Mozilla Firefox 3.0.2 through 3.0.10 allows remote attackers to cause a denial of service (NULL poi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
PHP 5.3.2 - 'xml_utf8_decode()' UTF-8 Input Validation
CVE-2010-3870—remotephp11 May 2009
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed su
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Compress::Raw::Zlib Perl Module - Remote Code Execution
CVE-2009-1391—remotelinux11 May 2009
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS,
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.x - Large '.GIF' File Background Denial of Service
CVE-2009-2044—doslinux10 May 2009
Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - JavaScript 'onload()' Event Cross Domain Scripting
CVE-2009-1684—remotemultiple08 May 2009
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone O
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Claroline 1.8.11 - '/claroline/linker/notfound.php' Cross-Site Scripting
CVE-2009-1907—webappsphp08 May 2009
Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - XML External Entity Information Disclosure
CVE-2009-1699—remotelinux08 May 2009
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for i
28RISK
open ↗
Exploit-DB✓ VexDay Proof
GrabIt 1.7.2x - NZB DTD Reference Buffer Overflow
CVE-2009-1586—localwindows07 May 2009
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Verlihub Control Panel 1.7 - Multiple Cross-Site Scripting Vulnerabilities
CVE-2009-2569—webappsphp06 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inje
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
CVE-2009-1553—remotemultiple05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
CVE-2009-1553—remotemultiple05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
CVE-2009-1585—webappsphp05 May 2009
Multiple SQL injection vulnerabilities in TemaTres 1.031, when magic_quotes_gpc is disabled, allow remote attackers to e
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Git 1.6.3 - Parameter Processing Remote Denial of Service
CVE-2009-2108—doslinux05 May 2009
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU cons
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow (PoC)
CVE-2009-2568—doswindows05 May 2009
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary co
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
CVE-2009-1553—remotemultiple05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Joomla! Component Almond Classifieds 5.6.2 - Blind SQL Injection
CVE-2009-2567—webappsphp05 May 2009
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
CVE-2009-1553—remotemultiple05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
CVE-2009-1553—remotemultiple05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting
CVE-2009-1467—webappsphp05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting
CVE-2009-1467—webappsphp05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
CVE-2009-1553—remotemultiple05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow
CVE-2009-2568—localwindows05 May 2009
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary co
23RISK
open ↗
Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation
CVE-2009-1469—webappsphp05 May 2009
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and Web
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Woodstock 4.2 404 - Error Page Cross-Site Scripting
CVE-2009-1554—remotemultiple05 May 2009
Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise
23RISK
open ↗
Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections
CVE-2009-1468—webappsphp05 May 2009
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eM
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VerliAdmin 0.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2009-2571—webappsphp05 May 2009
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to
23RISK
open ↗
← previouspage 448 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.