Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,401cataloged exploits
35,511CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,209VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
GIMP 2.2.14 - '.ras' SUNRAS Plugin Buffer Overflow
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-
28RISK
open ↗Exploit-DB✓ VexDay Proof
Doruk100Net - 'Info.php' Remote File Inclusion
PHP remote file inclusion vulnerability in info.php in Doruk100.net doruk100net allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - '.ani' GDI Remote Privilege Escalation (MS07-017)
Buffer overflow in the Graphics Device Interface (GDI) in Microsoft Windows 2000 SP4; XP SP2; Server 2003 Gold, SP1, and
23RISK
open ↗Exploit-DB✓ VexDay Proof
Burak Yilmaz Blog 1.0 - 'BRY.asp' SQL Injection
SQL injection vulnerability in bry.asp in Burak Yilmaz Blog 1.0 allows remote attackers to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
EsForum 3.0 - 'forum.php?idsalon' SQL Injection
SQL injection vulnerability in forum.php in EsForum 3.0 allows remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - '.ani' GDI Remote Privilege Escalation (MS07-017)
The Graphics Rendering Engine in Microsoft Windows 2000 SP4 and XP SP2 allows local users to gain privileges via "invali
23RISK
open ↗Exploit-DB✓ VexDay Proof
plesk 8.1.1 - 'login.php3' Directory Traversal
Multiple directory traversal vulnerabilities in SWsoft Plesk for Windows 7.6.1, 8.1.0, and 8.1.1 allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ahhp Portal - 'page.php' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in page.php in Ahhp-Portal allow remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
HYIP Manager Pro - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in HYIP Manager Pro allow remote attackers to execute arbitrary PHP c
23RISK
open ↗Exploit-DB✓ VexDay Proof
DynaTracker 1.5.1 - 'includes_handler.php?base_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes_handler.php in DynaTracker 151 allows remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
DynaTracker 1.5.1 - 'action.php?base_path' Remote File Inclusion
PHP remote file inclusion vulnerability in includes_handler.php in DynaTracker 151 allows remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Comus 2.0 - 'Accept.php' Remote File Inclusion
PHP remote file inclusion vulnerability in accept.php in comus 2.0 Final allows remote attackers to execute arbitrary PH
23RISK
open ↗Exploit-DB✓ VexDay Proof
HTMLEditBox 2.2 - 'config.php' Remote File Inclusion
PHP remote file inclusion vulnerability in _editor.php in HTMLeditbox 2.2 allows remote attackers to execute arbitrary P
23RISK
open ↗Exploit-DB✓ VexDay Proof
SunShop Shopping Cart 3.5/4.0 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart 4.0 allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyNewsGroups 0.6 - 'Include.php' Remote File Inclusion
PHP remote file inclusion vulnerability in include.php in MyNewsGroups :) allows remote attackers to execute arbitrary P
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Mailutils imap4d 0.6 - exec-shield Remote Format String
Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to e
28RISK
open ↗Exploit-DB✓ VexDay Proof
NetSprint Toolbar - ActiveX 'toolbar.dll' Denial of Service (PoC)
Buffer overflow in the isChecked function in toolbar.dll in Netsprint Toolbar 1.1 might allow remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
Second Sight Software - ActiveGS.ocx ActiveX Buffer Overflow (PoC)
Multiple stack-based buffer overflows in Second Sight Software ActiveGS ActiveX control (ActiveGS.ocx) allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cdelia Software ImageProcessing - '.BMP' File Denial of Service
Cdelia Software ImageProcessing allows user-assisted remote attackers to cause a denial of service (application crash) v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Second Sight Software - ActiveMod.ocx ActiveX Buffer Overflow (PoC)
Stack-based buffer overflow in Second Sight Software ActiveMod ActiveX control (ActiveMod.ocx) allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPMySpace Gold 8.10 - 'article.php' SQL Injection
SQL injection vulnerability in modules/news/article.php in phpMySpace Gold 8.10 allows remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime for Java 7 - Memory Access (Metasploit)
Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows rem
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime 7.1.5 - QTJava toQTPointer() Java Handling Arbitrary Code Execution
Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows rem
60RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 5.1.20 - 'admin.php' badwords/banlist Module SQL Injection
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ripe Website Manager 0.8.4 - '/contact/index.php?ripeformpost' SQL Injection
SQL injection vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 5.1.20 - 'admin.php?modsettings Module smiley_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 5.1.20 - 'admin.php?Groups Module group_id' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Phorum 5.1.20 - '/include/admin/banlist.php?delete' Cross-Site Request Forgery Banlist Deletion
Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
File117 - Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in html/php/detail.php in Sinato jmuffin allow remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
ACVSWS - 'Transport.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inc_ACVS/SOAP/Transport.php in Accueil et Conseil en Visites et Sejours Web S
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.