Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
DeluxeBB 1.09 - Remote Admin Email Change
cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.1 - Folded Mail Headers Email Header Injection
CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
SimpleGallery 0.1.3 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in SimpleGallery 0.1.3 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.1 - Folded Mail Headers Email Header Injection
The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ ('\0'
23RISK
open ↗Exploit-DB✓ VexDay Proof
FMDeluxe 2.1 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in FMDeluxe 2.1.0 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
VBTube 1.1 - Search Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime 7.2/7.3 (Windows Vista/XP) - RSTP Response Code Execution
Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac
50RISK
open ↗Exploit-DB✓ VexDay Proof
Bandersnatch 0.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Bandersnatch 0.4 allow remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
MySpace Scripts Poll Creator - 'index.php' HTML Injection
Multiple cross-site scripting (XSS) vulnerabilities in index.php in M2Scripts MySpace Scripts Poll Creator allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
VUNET Mass Mailer - 'default.asp' SQL Injection
SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
ISPmanager 4.2.15 - Responder Privilege Escalation
The responder program in ISPsystem ISPmanager (aka ISPmgr) 4.2.15.1 allows local users to gain privileges via shell meta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.5.x - Mail Arbitrary Code Execution
Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDoub
50RISK
open ↗Exploit-DB✓ VexDay Proof
Citrix Netscaler 8.0 build 47.8 - Generic_API_Call.pl Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ws/generic_api_call.pl in Citrix NetScaler 8.0 build 47.8 allows remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
LIVE555 Media Server 2007.11.1 - ParseRTSPRequestString Remote Denial of Service
The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a de
23RISK
open ↗Exploit-DB✓ VexDay Proof
I Hear U 0.5.6 - Multiple Remote Denial of Service Vulnerabilities
I Hear U (IHU) 0.5.6 and earlier allows remote attackers to cause (1) a denial of service (infinite loop) via a packet t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Rigs of Rods 0.33d - 'Vehicle Name' Buffer Overflow
Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33
23RISK
open ↗Exploit-DB✓ VexDay Proof
JiRo's Banner System 2.0 - 'login.asp' Multiple SQL Injections
Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System (JBS) 2.0, and possibly JiRo's Upload
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Jet Engine - '.MDB' File Parsing Stack Overflow
Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Mi
28RISK
open ↗Exploit-DB✓ VexDay Proof
Liferay Portal 4.1 Login Script - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
BlueZ 1.x/2.x - HIDD Bluetooh HID Command Injection
hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the (1) Mouse and (2) Keyboard Huma
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.4.x Kernel - 'i386_set_ldt()' Integer Overflow (PoC)
Integer overflow in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Websphere Application Server 5.1.1 - WebContainer HTTP Request Header Security
Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1
23RISK
open ↗Exploit-DB✓ VexDay Proof
Aruba MC-800 Mobility Controller - Screens Directory HTML Injection
Cross-site scripting (XSS) vulnerability in the login page in the management interface in the Aruba 800 Mobility Control
23RISK
open ↗Exploit-DB✓ VexDay Proof
ComponentOne FlexGrid 7.1 - ActiveX Control Multiple Buffer Overflow Vulnerabilities
Multiple stack-based buffer overflows in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne FlexGrid 7.1 Light a
23RISK
open ↗Exploit-DB✓ VexDay Proof
KDE Konqueror 3.5.6 - Cookie Handling Denial of Service
KDE Konqueror 3.5.6 and earlier allows remote attackers to cause a denial of service (crash) via large HTTP cookie param
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service
Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "
28RISK
open ↗Exploit-DB✓ VexDay Proof
AIDA Web - Frame.HTML Multiple Unauthorized Access Vulnerabilities
frame.html in Aida-Web (Aida Web) allows remote attackers to bypass a protection mechanism and obtain comment and task d
23RISK
open ↗Exploit-DB✓ VexDay Proof
CONTENTCustomizer 3.1 - 'Dialog.php' Unauthorized Access
dialog.php in CONTENTCustomizer 3.1mp and earlier allows remote attackers to perform certain privileged actions via a (1
33RISK
open ↗Exploit-DB✓ VexDay Proof
WebEx GPCContainer - Memory Access Violation Multiple Denial of Service Vulnerabilities
Unspecified vulnerability in the GpcContainer.GpcContainer.1 ActiveX control in WebEx allows remote attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Server 2000/2003 - Recursive DNS Spoofing (1)
The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.