Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Boa 0.93.15 - Administrator Password Overwrite Authentication Bypass
The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent st
50RISK
open ↗Exploit-DB✓ VexDay Proof
JBlog 1.0 - 'index.php?id' SQL Injection
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accou
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP - ActiveX 'hpqutil.dll' ListFiles Remote Heap Overflow (PoC)
Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC
28RISK
open ↗Exploit-DB✓ VexDay Proof
WinSCP 4.0.3 - URL Protocol Handler Arbitrary File Access
Interpretation conflict in WinSCP before 4.0.4 allows remote attackers to perform arbitrary file transfers with a remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
GForge < 4.6b2 - 'skill_delete' SQL Injection
SQL injection vulnerability in Gforge before 3.1 allows remote attackers to execute arbitrary SQL commands via unspecifi
23RISK
open ↗Exploit-DB✓ VexDay Proof
KMPlayer 2.9.3.1214 - Multiple Remote Denial of Service Vulnerabilities
KMPlayer 2.9.3.1210 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a .avi file w
23RISK
open ↗Exploit-DB✓ VexDay Proof
CS-Guestbook 0.1 - Login Credentials Information Disclosure
CS Guestbook stores sensitive information under the web root with insufficient access control, which allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
MPlayer 1.0 - AVIHeader.C Heap Buffer Overflow
Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a de
28RISK
open ↗Exploit-DB✓ VexDay Proof
BOINC 5.10.20 - 'text_search_action.php?search_string' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Boinc Forum 5.10.20 and earlier allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Media Player Classic 6.4.9 - Malformed AVI Header Multiple Remote Vulnerabilities
Heap-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in
28RISK
open ↗Exploit-DB✓ VexDay Proof
BOINC 5.10.20 - 'forum_forum.php?id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Boinc Forum 5.10.20 and earlier allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
SWSoft Plesk 8.2 - 'login.php3' PLESKSESSID Cookie SQL Injection
Multiple SQL injection vulnerabilities in SWSoft Plesk 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Windows allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Agent - 'agentdpv.dll' ActiveX Control Malformed URL Stack Buffer Overflow
Stack-based buffer overflow in agentdpv.dll 2.0.0.3425 in Microsoft Agent on Windows 2000 SP4 allows remote attackers to
35RISK
open ↗Exploit-DB✓ VexDay Proof
CellFactor REvolution 1.03 - Multiple Remote Code Execution Vulnerabilities
Multiple buffer overflows in CellFactor Revolution 1.03 and earlier allow remote attackers to execute arbitrary code via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Focus/SIS 1.0/2.2 - Remote File Inclusion
PHP remote file inclusion vulnerability in modules/Discipline/StudentFieldBreakdown.php in Focus/SIS 1.0 allows remote a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Toms Gastebuch 1.00/1.01 - 'header.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in admin/header.php in Toms Gaestebuch 1.01 and earlier allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Toms Gästebuch 1.00 - '/admin/header.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Toms Gaestebuch 1.00 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Toms Gästebuch 1.00 - 'form.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Toms Gaestebuch 1.00 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Trend Micro ServerProtect - 'eng50.dll' Remote Stack Overflow
Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance F
60RISK
open ↗Exploit-DB✓ VexDay Proof
Unreal Commander 0.92 - Directory Traversal
Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to creat
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alien Arena 2007 6.10 - Multiple Remote Vulnerabilities
Format string vulnerability in the safe_bprintf function in acesrc/acebot_cmds.c in Alien Arena 2007 6.10 and earlier al
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 5.5.15 - cal2.jsp Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0
45RISK
open ↗Exploit-DB✓ VexDay Proof
AkkyWareHOUSE '7-zip32.dll' 4.42 - Heap Buffer Overflow
Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04, as derived from Igor Pavlov 7-Zip before
23RISK
open ↗Exploit-DB✓ VexDay Proof
Move Media Player 1.0 Quantum Streaming - ActiveX Control Multiple Buffer Overflow Vulnerabilities
Multiple stack-based buffer overflows in the Quantum Streaming Internet Explorer Player ActiveX control in qsp2ie0705100
28RISK
open ↗Exploit-DB✓ VexDay Proof
E-Smart Cart 1.0 - 'login.asp' SQL Injection
Multiple SQL injection vulnerabilities in embadmin/login.asp in E-SMARTCART 1.0 allow remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
212Cafe WebBoard 6.30 - 'Read.php' SQL Injection
SQL injection vulnerability in read.php in 212cafeBoard 6.30 Beta allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
Claroline 1.x - '/admin/advancedUserSearch.php?action' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators
23RISK
open ↗Exploit-DB✓ VexDay Proof
Claroline 1.x - '/admin/campusProblem.php?view' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime < 7.2 - SMIL Remote Integer Overflow
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to ex
28RISK
open ↗Exploit-DB✓ VexDay Proof
STPHPLibrary - 'STPHPLIB_DIR' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.