Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Aspee Ziyaretci Defteri - 'giris.asp' Multiple Field SQL Injections
Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
NetBSD 3.1 - 'FTPd / Tnftpd' Port Remote Buffer Overflow
Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before
28RISK
open ↗Exploit-DB✓ VexDay Proof
ContentServ 4.x - '/admin/FileServer.php' File Disclosure
Directory traversal vulnerability in admin/FileServer.php in ContentServ 4.x allows remote attackers to read arbitrary f
23RISK
open ↗Exploit-DB✓ VexDay Proof
DZCP (deV!L_z Clanportal) 1.3.6 - Arbitrary File Upload
Unrestricted file upload vulnerability in upload/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
BlazeVideo HDTV Player 2.1 - '.PLF' Local Buffer Overflow
Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code
28RISK
open ↗Exploit-DB✓ VexDay Proof
phpGraphy 0.9.12 - Privilege Escalation / Commands Execution
phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value
23RISK
open ↗Exploit-DB✓ VexDay Proof
Acer LunchApp.APlunch - ActiveX Control Command Execution
Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run
28RISK
open ↗Exploit-DB✓ VexDay Proof
Seditio1.10 / Land Down 8.0 Under - 'polls.php' SQL Injection
SQL injection vulnerability in polls.php in Neocrome Seditio 1.10 and earlier allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
NetBSD - 'FTPd / Tnftpd' Remote Stack Overflow (PoC)
Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before
28RISK
open ↗Exploit-DB✓ VexDay Proof
LDU 8.x - 'polls.php' SQL Injection
SQL injection vulnerability in polls.php in Neocrome Land Down Under (LDU) 8.x and earlier allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Remote Overflow
Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a d
60RISK
open ↗Exploit-DB✓ VexDay Proof
b2evolution 1.8.5 < 1.9b - 'import-mt.php' Remote File Inclusion
PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1.9 beta allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable 2.x - SMTP NTLM Multiple Authentication Vulnerabilities
The NTLM authentication in MailEnable Professional 2.0 and Enterprise 2.0 allows remote attackers to (1) execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.4.x - 'Shared_Region_Make_Private_Np' Kernel Function Local Memory Corruption
Buffer overflow in the shared_region_make_private_np function in vm/vm_unix.c in Mac OS X 10.4.6 and earlier allows loca
23RISK
open ↗Exploit-DB✓ VexDay Proof
P-News 2.0 - 'user.txt' Remote Password Disclosure
P-News 2.0 stores db/user.txt under the web document root with insufficient access control, which allows remote attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
Clickblog - 'Displaycalendar.asp' SQL Injection
SQL injection vulnerability in displayCalendar.asp in ClickTech Click Blog allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
uPhotoGallery 1.1 - 'thumbnails.asp?ci' SQL Injection
Multiple SQL injection vulnerabilities in Uapplication UPhotoGallery 1.1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
uPhotoGallery 1.1 - 'Slideshow.asp?ci' SQL Injection
Multiple SQL injection vulnerabilities in Uapplication UPhotoGallery 1.1 allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
ClickContact - 'default.asp' Multiple SQL Injections
Multiple SQL injection vulnerabilities in default.asp in ClickTech ClickContact allow remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Overflow (PoC)
Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a d
60RISK
open ↗Exploit-DB✓ VexDay Proof
Evolve Shopping Cart - 'products.asp' SQL Injection
SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.4.x - AppleTalk AIOCRegLocalZN IOCTL Stack Buffer Overflow
Apple Mac OS X AppleTalk allows local users to cause a denial of service (kernel panic) by calling the AIOCREGLOCALZN io
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProFTPd 1.3.0 - 'sreplace' Remote Stack Overflow (Metasploit)
Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably auth
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX 10.4.x - Mach-O Binary Loading Integer Overflow
Integer overflow in the fatfile_getarch2 in Apple Mac OS X allows local users to cause a denial of service and possibly
23RISK
open ↗Exploit-DB✓ VexDay Proof
fipsShop - Multiple SQL Injections
Multiple SQL injection vulnerabilities in index.asp in FipsSHOP allow remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'dofeaturemanager?feature' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sisfo Kampus 0.8 - Remote File Inclusion / Download
PHP remote file inclusion vulnerability in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to execute arbitrary P
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'addon_configsupport.cgi?supporturl' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'dochangeemail?email' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel WebHost Manager 3.1 - 'editpkg?pkg' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated use
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.