Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Mambo Component Reporter 1.0 - 'Reporter.sql.php' Remote File Inclusion
PHP remote file inclusion vulnerability in processor/reporter.sql.php in the Reporter Mambo component (com_reporter) all
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.4.3/5.1.4 - 'sscanf' Local Buffer Overflow
scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - 'IMSKDIC.dll' Denial of Service
Microsoft Internet Explorer 6.0 SP1 and possibly other versions allows remote attackers to cause a denial of service and
35RISK
open ↗Exploit-DB✓ VexDay Proof
Zen Cart Web Shopping Cart 1.3.0.2 - 'autoload_func.php?autoLoadConfig[999][0][loadFile]' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in Zen Cart 1.3.0.2 and earlier, when register_globals is enabled,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 1.x - XML Handler Race Condition Memory Corruption
20RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 2.0 AutoHTML Module - Local File Inclusion
Directory traversal vulnerability in autohtml.php in the AutoHTML module for PHP-Nuke allows local users to include arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - 'MSOE.dll' Denial of Service
Microsoft Internet Explorer 6.0 SP1 and possibly other versions allows remote attackers to cause a denial of service and
35RISK
open ↗Exploit-DB✓ VexDay Proof
Lizge 20 - 'index.php' Multiple Remote File Inclusions
Multiple PHP remote file inclusion vulnerabilities in index.php in Lizge V.20 Web Portal allow remote attackers to execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
WEBInsta CMS 0.3.1 - 'users.php' Remote File Inclusion
PHP remote file inclusion vulnerability in modules/usersonline/users.php in WEBInsta CMS 0.3.1 allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP-DB Backup 1.6/1.7 - 'edit.php' Directory Traversal
Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows
28RISK
open ↗Exploit-DB✓ VexDay Proof
Libmusicbrainz 2.0.2/2.1.x - Multiple Buffer Overflow Vulnerabilities
Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier, and SVN 840
28RISK
open ↗Exploit-DB✓ VexDay Proof
ImageMagick 6.x - '.SGI' Image File Remote Heap Buffer Overflow
Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cau
28RISK
open ↗Exploit-DB✓ VexDay Proof
Cyrus IMAPD 2.3.2 - 'pop3d' Remote Buffer Overflow (3)
Stack-based buffer overflow in pop3d in Cyrus IMAPD (cyrus-imapd) 2.3.2, when the popsubfolders option is enabled, allow
50RISK
open ↗Exploit-DB✓ VexDay Proof
Linux-HA Heartbeat 2.0.6 - Remote Denial of Service
The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 1.0.x - JavaScript Handler Race Condition Memory Corruption
Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (c
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/2003 help - Multiple Vulnerabilities
Multiple unspecified vulnerabilities in Microsoft Windows Help File viewer (winhlp32.exe) allow user-assisted attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
IPCheck Server Monitor 5.x - Directory Traversal
Directory traversal vulnerability in IPCheck Server Monitor before 5.3.3.639/640 allows remote attackers to read arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Component Remository 3.25 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.remository.php in the Remository Component (com_remository) 3.25 and ea
23RISK
open ↗Exploit-DB✓ VexDay Proof
Panda ActiveScan 5.53 - 'Ascan_6.asp' ActiveX Control Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ascan_6.asp in Panda ActiveScan 5.53.00 allows remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
VWar 1.50 R14 - 'online.php' SQL Injection
Multiple SQL injection vulnerabilities in the Virtual War (VWar) 1.5.0 R15 module for PHP-Nuke allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Thatware 0.4.6 - 'ROOT_PATH' Remote File Inclusion
PHP remote file inclusion vulnerability in config.php in Thatware 0.3 through 0.5.3 allows remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mafia Moblog 6 - 'Big.php' Remote File Inclusion
PHP remote file inclusion vulnerability in big.php in pearlabs mafia moblog 6 and earlier allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
miniBloggie 1.0 - 'Fname' Remote File Inclusion
PHP remote file inclusion vulnerability in cls_fast_template.php in myWebland miniBloggie 1.0 and earlier allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - NetpIsRemote() Remote Overflow (MS06-040) (Metasploit)
Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote a
60RISK
open ↗Exploit-DB✓ VexDay Proof
YaBBSE 1.x - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Yet another Bulletin Board (YaBB) allows remote attackers to in
23RISK
open ↗Exploit-DB✓ VexDay Proof
OpenMPT 1.17.02.43 - Multiple Remote Buffer Overflows (PoC)
Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tagger Luxury Edition - 'BBCodeFile' Remote File Inclusion
Eval injection vulnerability in Tagger LE allows remote attackers to execute arbitrary PHP code via the query string in
23RISK
open ↗Exploit-DB✓ VexDay Proof
ArcSoft Mms Composer 1.5.5/2.0 - Multiple Vulnerabilities
Multiple buffer overflows in ArcSoft MMS Composer 1.5.5.6, and possibly earlier, and 2.0.0.13, and possibly earlier, all
23RISK
open ↗Exploit-DB✓ VexDay Proof
IrfanView 3.98 - '.ANI' Image File Denial of Service
IrfanView 3.98 (with plugins) allows user-assisted attackers to cause a denial of service (application crash) via a craf
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.