Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Plunet BusinessManager 4.1 - 'pagesUTF8/Sys_DirAnzeige.jsp?Pfad' Direct Request Information Disclosure
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sens
23RISK
open ↗Exploit-DB✓ VexDay Proof
QuoteBook - Remote Configuration File Disclosure
Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1)
23RISK
open ↗Exploit-DB✓ VexDay Proof
Multiple CA Service Management Products - Remote Command Execution
The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not pro
35RISK
open ↗Exploit-DB✓ VexDay Proof
Plunet BusinessManager 4.1 - '/pagesUTF8/auftrag_allgemeinauftrag.jsp' Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and ear
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 10g - SYS.LT.REMOVEWORKSPACE SQL Injection
Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3,
50RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 10g - SYS.LT.MERGEWORKSPACE SQL Injection
Unspecified vulnerability in the Workspace Manager component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.3,
50RISK
open ↗Exploit-DB✓ VexDay Proof
Goople 1.8.2 - 'FrontPage.php' Blind SQL Injection
SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (1)
Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code
50RISK
open ↗Exploit-DB✓ VexDay Proof
Destiny Media Player 1.61 - '.lst' Local Buffer Overflow (PoC)
Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code
50RISK
open ↗Exploit-DB✓ VexDay Proof
Destiny Media Player 1.61 - '.m3u' Local Stack Overflow
Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code
50RISK
open ↗Exploit-DB✓ VexDay Proof
Destiny Media Player 1.61 - '.m3u' Local Buffer Overflow (PoC)
Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code
50RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.8 gd library - 'imageRotate()' Information Leak
Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Viart shopping cart 3.5 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3.2 WebKit - 'alink' Property Memory Leak Remote Denial of Service (2)
Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPFootball 1.6 - Remote Hash Disclosure
Multiple cross-site scripting (XSS) vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3.2 WebKit - 'alink' Property Memory Leak Remote Denial of Service (1)
Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause
23RISK
open ↗Exploit-DB✓ VexDay Proof
Megacubo 5.0.7 - 'mega://' Arbitrary File Download and Execute
Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPFootball 1.6 - Remote Hash Disclosure
SQL injection vulnerability in login.php in PHPFootball 1.6 allows remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Viart shopping cart 3.5 - Multiple Vulnerabilities
ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to access the contents of an arbitrary shopping cart via a mo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Audio File Library 0.2.6 - libaudiofile 'msadpcm.c .WAV' File Processing Buffer Overflow
Heap-based buffer overflow in msadpcm.c in libaudiofile in audiofile 0.2.6 allows context-dependent attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 9/10/11 - '.WAV' File Parsing Code Execution
Integer overflow in quartz.dll in the DirectShow framework in Microsoft Windows Media Player (WMP) 9, 10, and 11, includ
28RISK
open ↗Exploit-DB✓ VexDay Proof
ViArt Shop 3.5 - 'manuals_search.php?manuals_search' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in manuals_search.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
xterm - DECRQSS Remote Command Execution
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, whic
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chilkat FTP - ActiveX (SaveLastError) Insecure Method
Insecure method vulnerability in Chilkat Mail 7.8 ActiveX control (ChilkatCert.dll) allows remote attackers to overwrite
23RISK
open ↗Exploit-DB✓ VexDay Proof
Miniweb 2.0 - Authentication Bypass
SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chilkat FTP - ActiveX (SaveLastError) Insecure Method
The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component 5starhotels - SQL Injection
SQL injection vulnerability in the com_lowcosthotels component in the Hotel Booking Reservation System (aka HBS) for Joo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component 5starhotels - SQL Injection
SQL injection vulnerability in the com_hbssearch component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 f
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component 5starhotels - SQL Injection
SQL injection vulnerability in the Top Hotel (com_tophotelmodule) component 1.0 in the Hotel Booking Reservation System
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.5 - location.hash Remote Crash
Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote attackers to cause a denial of service (CPU consumption)
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.