Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,533cataloged exploits
35,607CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-comments-post.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in JD-WordPress for Joomla! (com_jd-wp) 2.0-1.0 RC2 allow remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 1.5.0.4 - JavaScript Navigator Object Code Execution
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by chang
60RISK
open ↗Exploit-DB✓ VexDay Proof
GeoClassifieds Enterprise 2.0.5.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in GeoClassifieds Enterprise 2.0.5.2 and earlier allows remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/2003 - Explorer Drag and Drop Remote Code Execution
Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attacke
35RISK
open ↗Exploit-DB✓ VexDay Proof
MidiRecord2 MidiRecord.CC - Local Buffer Overflow
Buffer overflow in the daemon function in midirecord.cc in Tuomas Airaksinen Midirecord 2.0 allows local users to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - NDFXArtEffects Stack Overflow
Stack-based buffer overflow in NDFXArtEffects in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
Bosdates 3.x/4.0 - 'Payment.php' Remote File Inclusion
PHP remote file inclusion vulnerability in payment.php in BosDev BosDates allows remote attackers to execute arbitrary P
23RISK
open ↗Exploit-DB
ZYXEL Prestige 660H-61 ADSL Router - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Forms/rpSysAdmin script on the Zyxel Prestige 660H-61 ADSL Router runnin
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux-HA Heartbeat 1.2.3/2.0.x - Insecure Default Permissions on Shared Memory
heartbeat.c in heartbeat before 2.0.6 sets insecure permissions in a shmget call for shared memory, which allows local u
23RISK
open ↗Exploit-DB✓ VexDay Proof
eIQnetworks License Manager - Remote Buffer Overflow (multi) (1)
Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in product
60RISK
open ↗Exploit-DB✓ VexDay Proof
wwwThreads - 'calendar.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in calendar.php in WWWthreads allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2)
Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in product
60RISK
open ↗Exploit-DB✓ VexDay Proof
eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1)
Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in product
60RISK
open ↗Exploit-DB✓ VexDay Proof
phpBB-Auction 1.x - 'auction_store.php?u' SQL Injection
Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpBB-Auction 1.x - 'auction_room.php?ar' SQL Injection
Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via (1)
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Suite/Firefox < 1.5.0.5 - Navigator Object Code Execution (Metasploit)
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by chang
60RISK
open ↗Exploit-DB✓ VexDay Proof
LinksCaffe 3.0 - 'menu.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish LinksCaffe 3.0 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
LinksCaffe 3.0 - 'counter.php?tablewidth' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish LinksCaffe 3.0 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPSavant Savant2 - 'Stylesheet.php?MosConfig_absolute_path' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree compo
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Pro Bid 5.2.4 - 'auctionsearch.php?advsrc' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in auctionsearch.php in PhpProBid 5.24 allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
LinksCaffe 3.0 - 'links.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Pro Bid 5.2.4 - 'viewfeedback.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Pro Bid 5.2.4 - 'categories.php?orderType' SQL Injection
Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
libmikmod 3.2.2 - GT2 Loader Local Heap Overflow (PoC)
Integer overflow in the loadChunk function in loaders/load_gt2.c in libmikmod in Mikmod Sound System 3.2.2 allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
LinksCaffe 3.0 - 'links.php?newdays' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Gonafish LinksCaffe 3.0 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/2003 - Remote Denial of Service
Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003 allow remote attackers to cau
28RISK
open ↗Exploit-DB✓ VexDay Proof
MusicBox 2.3.4 - 'page' SQL Injection
SQL injection vulnerability in Shalwan MusicBox 2.3.4 and earlier allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - Native Function Iterator Denial of Service
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iteratin
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mambo Component PrinceClan Chess 0.8 - Remote File Inclusion
Unspecified vulnerability in Prince Clan (Princeclan) Chess component (com_pcchess) 0.8 and earlier for Mambo and Joomla
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 10 - 'sysinfo()' Local Kernel Memory Disclosure (1)
systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo sys
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.