Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,231cataloged exploits
35,420CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,266GitHub PoC 14,131VulnCheck XDB 8,635Nuclei 4,274Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
EJ3 BlackBook 1.0 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Call of Duty 4 1.5 - 'stats' Denial of Service
Call of Duty 4 (CoD4) 1.5 and earlier allows remote authenticated users to cause a denial of service (crash) via a type
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chicomas 2.0.4 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
EJ3 BlackBook 1.0 - 'header.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in EJ3 BlackBook 1.0 allow remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
VWar 1.6.1 R2 - Multiple Remote Vulnerabilities
SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
MJGUEST 6.7 - 'QT 'mjguest.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mjguest.php in Mjguest 6.7 GT Rev.01 allows remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
C-News 1.0.1 - 'install.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in install.php in C-News.fr C-News 1.0.1 allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
PeerCast 0.1218 - 'getAuthUserPass' Multiple Buffer Overflow Vulnerabilities
Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-pe
28RISK
open ↗Exploit-DB✓ VexDay Proof
LibTiff 3.x - Double-Free Memory Corruption
Double free vulnerability in tif_jpeg.c in libtiff before 3.8.1 allows context-dependent attackers to cause a denial of
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Alphacontent 2.5.8 - Blind SQL Injection
SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion
PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component
43RISK
open ↗Exploit-DB✓ VexDay Proof
Siteman 2.0.x2 - 'module' Cross-Site Scripting / Local File Inclusion
Cross-site scripting (XSS) vulnerability in index.php in Siteman 2.0.x2 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Heap-based buffer overflow in the libaccess_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows m
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Array index error in the sdpplin_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
The MP4 demuxer (mp4.c) for VLC media player 0.8.6d and earlier, as used in Miro Player 1.1 and earlier, allows remote a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Heap-based buffer overflow in modules/access/rtsp/real_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Play
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Integer overflow in the MP4_ReadBox_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial o
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kantaris 0.3.4 - SSA Subtitle Local Buffer Overflow
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitr
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHCDownload 1.1 - '/admin/index.php?hash' SQL Injection
SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHCDownload 1.1 - '/upload/install/index.php?step' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Computer Associates ARCserve Backup Discovery Service Remote - Denial of Service
The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Expeditor 6.1 - URI Handler Command Execution
Argument injection vulnerability in the cai: URI handler in rcplauncher in IBM Lotus Expeditor Client for Desktop 6.1.1
28RISK
open ↗Exploit-DB✓ VexDay Proof
Pixel Motion Blog - 'list_article.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in liste_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Eclipse 3.3.2 IDE - 'Help Server help/advanced/workingSetManager.jsp?workingSet' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclips
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke DownloadsPlus Module - Arbitrary File Upload
Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Eclipse 3.3.2 IDE - 'Help Server help/advanced/searchView.jsp?SearchWord' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclips
23RISK
open ↗Exploit-DB✓ VexDay Proof
Digital Hive 2.0 - 'base.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in base.php in DigitalHive 2.0 RC2 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Horde Webmail 1.0.6 - 'addevent.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and
23RISK
open ↗Exploit-DB✓ VexDay Proof
F5 Networks FirePass 4100 SSL VPN - 'installControl.php3' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allo
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.