Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,618cataloged exploits
35,646CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,268VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
PhotoCycle 1.0 - 'PhotoCycle.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in photocycle in Photocycle 1.0 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (3)
The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a l
23RISK
open ↗Exploit-DB✓ VexDay Proof
Lazarus Guestbook 1.6 - 'picture.php?img' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - RevealTrans Denial of Service
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Transition pro
28RISK
open ↗Exploit-DB✓ VexDay Proof
Lazarus Guestbook 1.6 - 'codes-english.php?show' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (2)
The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a l
23RISK
open ↗Exploit-DB✓ VexDay Proof
FLV Players 8 - 'popup.php?url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in FLV Players 8 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
FlexWATCH 3.0 - 'AIndex.asp' Authentication Bypass
Directory traversal vulnerability in FlexWATCH Network Camera 3.0 and earlier allows remote attackers to bypass access r
23RISK
open ↗Exploit-DB✓ VexDay Proof
FLV Players 8 - 'player.php?url' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in FLV Players 8 allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - TriEditDocument Denial of Service
Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the
28RISK
open ↗Exploit-DB✓ VexDay Proof
Fantastic Guestbook 2.0.1 - 'Guestbook.php' HTML Injection
Multiple cross-site scripting (XSS) vulnerabilities in guestbook.php in Fantastic Guestbook 2.0.1, and possibly earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
SaPHPLesson 2.0 - 'add.php' SQL Injection
SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) for
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.13 < 2.6.17.4 - 'sys_prctl()' Local Privilege Escalation (1)
The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a l
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office 2000/2002 - Property Code Execution
Unspecified vulnerability in Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, and other products, allo
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - 'HtmlDlgSafeHelper' Remote Denial of Service
Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the fonts
28RISK
open ↗Exploit-DB✓ VexDay Proof
SIPfoundry sipXtapi - 'CSeq' Remote Buffer Overflow (PoC)
Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Word 2000/2003 - Unchecked Boundary Condition
Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other
35RISK
open ↗Exploit-DB✓ VexDay Proof
Farsinews 3.0 - 'Tiny_mce_gzip.php' Directory Traversal
Directory traversal vulnerability in jscripts/tiny_mce/tiny_mce_gzip.php in FarsiNews 3.0 BETA 1 allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Graffiti Forums 1.0 - 'Topics.php' SQL Injection
SQL injection vulnerability in topics.php in Blue Dojo Graffiti Forums 1.0 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - Object.Microsoft.DXTFilter Denial of Service
Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) by setting the Enabled pr
28RISK
open ↗Exploit-DB✓ VexDay Proof
Webvizyon - 'SayfalaAltList.asp' SQL Injection
SQL injection vulnerability in SayfalaAltList.asp in Webvizyon Portal 2006 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - DirectAnimation.DAUserData Denial of Service
danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - RDS.DataControl Denial of Service
The Remote Data Service Object (RDS.DataControl) in Microsoft Internet Explorer 6 on Windows 2000 allows remote attacker
28RISK
open ↗Exploit-DB✓ VexDay Proof
RW::Download - 'stats.php' Remote File Inclusion
PHP remote file inclusion vulnerability in stats.php in RW::Download, when register_globals is enabled, allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
ATutor 1.5.3 - Multiple Input Validation Vulnerabilities
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Extcalendar 2.0 - 'Extcalendar.php' Remote File Inclusion
PHP remote file inclusion vulnerability in extcalendar.php in Mohamed Moujami ExtCalendar 2.0 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6 - Table.Frameset NULL Dereference
Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table wit
28RISK
open ↗Exploit-DB✓ VexDay Proof
Pivot 1.30 RC2 - Privilege Escalation / Remote Code Execution
PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier, when register_globals is enable
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pivot 1.30 RC2 - Privilege Escalation / Remote Code Execution
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, all
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.