Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Jetbox CMS 2.1 - view/supplynews Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jetbox CMS 2.1 - '/view/search/?path' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure
Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the sys
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jetbox CMS 2.1 Email - 'FormMail.php' Input Validation
formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails (spam) via modified recipient, _SETTING
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Vista - Forged ARP packet Network Stack Denial of Service
Microsoft Windows XP and Vista overwrites ARP table entries included in gratuitous ARP, which allows remote attackers to
28RISK
open ↗Exploit-DB✓ VexDay Proof
Caucho Resin 3.1 - '/web-inf' Traversal Arbitrary File Access
Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
SonicBB 1.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in SonicBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow (Metasploit)
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers
60RISK
open ↗Exploit-DB✓ VexDay Proof
webdesproxy 0.0.1 - 'exec-shield' GET Remote Code Execution
Buffer overflow in webdesproxy 0.0.1 allows remote attackers to execute arbitrary code via a long URL, possibly involvin
23RISK
open ↗Exploit-DB✓ VexDay Proof
Clever Database Comparer ActiveX 2.2 - Remote Buffer Overflow (PoC)
Stack-based buffer overflow in the Clever Database Comparer 2.2 ActiveX control (comparerax.ocx) allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
SonicBB 1.0 - 'search.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in search.php in SonicBB 1.0 allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
NagiosQL 2005 2.00 - 'prepend_adm.php' Remote File Inclusion
PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2.00-P00 and earlier allows remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Akismet 2.1.3 - Cross-Site Scripting
Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact
28RISK
open ↗Exploit-DB✓ VexDay Proof
CommuniGate Pro 5.1.8 - Web Mail HTML Injection
Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using
28RISK
open ↗Exploit-DB✓ VexDay Proof
EQdkp 1.3.1 - Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP FirstPost 0.1 - 'block.php?Include' Remote File Inclusion
PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP c
23RISK
open ↗Exploit-DB✓ VexDay Proof
TFTP Server TFTPDWin 0.4.2 - Directory Traversal
Directory traversal vulnerability in TFTPdWin 0.4.2 allows remote attackers to read or modify arbitrary files outside th
23RISK
open ↗Exploit-DB✓ VexDay Proof
LibEXIF 0.6.x - Exif_Data_Load_Data_Entry Remote Integer Overflow
Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 7 - Arbitrary File Rewrite (MS07-027)
Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Expl
35RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Microsystems Solaris SRSEXEC 3.2.x - Arbitrary File Read Local Information Disclosure
srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file per
38RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Multi User Randomizer 2006.09.13 - 'Configure_Plugin.TPL.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in PHP Multi User Randomizer (phpMUR) 2006.09.13 allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
McAfee Security Center IsOldAppInstalled - ActiveX Buffer Overflow
Buffer overflow in the IsOldAppInstalled function in the McSubMgr.McSubMgr Subscription Manager ActiveX control (MCSUBMG
23RISK
open ↗Exploit-DB✓ VexDay Proof
Barcodewiz ActiveX Control 2.52 - 'Barcodewiz.dll' Overwrite (SEH)
Stack-based buffer overflow in the Verify function in the BarCodeWiz ActiveX control 2.0 and 2.52 (BarcodeWiz.dll) allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Barcodewiz ActiveX Control 2.0 - 'Barcodewiz.dll' Remote Buffer Overflow (PoC)
Stack-based buffer overflow in the Verify function in the BarCodeWiz ActiveX control 2.0 and 2.52 (BarcodeWiz.dll) allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
aForum 1.32 - 'CommonAbsDir' Remote File Inclusion
PHP remote file inclusion vulnerability in common/errormsg.php in aForum 1.32 and possibly earlier, when register_global
23RISK
open ↗Exploit-DB✓ VexDay Proof
GDivX Zenith Player AviFixer Class - 'fix.dll 1.0.0.1' Buffer Overflow (PoC)
SQL injection vulnerability in browse.php in Ed Charkow SuperCharged Linking allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
CA (Multiple Products) - Console Server / 'InoCore.dll' Remote Code Execution
CA Anti-Virus for the Enterprise r8 and Threat Manager r8 before 20070510 use weak permissions (NULL security descriptor
23RISK
open ↗Exploit-DB✓ VexDay Proof
GIMP 2.2.14 (Windows x86) - '.ras' Download/Execute Buffer Overflow
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5.0.1 - 'TBLinf32.dll' ActiveX Control Remote Code Execution
The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsa
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe RoboHelp - Frameset-7.HTML Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Adobe RoboHelp X5, 6, and Server 6 allows remote attackers to inject arbitra
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.