Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,620cataloged exploits
35,647CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,429GitHub PoC 14,270VulnCheck XDB 8,693Nuclei 4,299Metasploit 3,474✓ verified onlyrecentpopularrisk
24,455 exploits
Exploit-DB✓ VexDay Proof
Open Wiki 0.78 - 'ow.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ow.asp in OpenWiki 0.78 allows remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
BoastMachine 3.1 - 'admin.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in (1) index.php and (2) bmc/admin.php in BoastMachine (bMachine) 3.1 and earli
23RISK
open ↗Exploit-DB✓ VexDay Proof
obotix IP Camera M1 1.9.4 .7/M10 2.0.5.2 - 'eventplayer?get_image_info_abspath' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mobotix IP Network Cameras M1 1.9.4.7 and M10 2.0.5.2, and other
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ipswitch WhatsUp Professional 2006 - Authentication Bypass
Ipswitch WhatsUp Professional 2006 only verifies the user's identity via HTTP headers, which allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
DeluxeBB 1.06 - 'Attachment mod_mime' Remote Command Execution
DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Caucho Resin 3.0.17/3.0.18 - Viewfile Information Disclosure
The viewfile servlet in the documentation package (resin-doc) for Caucho Resin 3.0.17 and 3.0.18 allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Fusion 6.00.306 - 'srch_where' SQL Injection
SQL injection vulnerability in messages.php in PHP-Fusion 6.00.307 and earlier allows remote authenticated users to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPRemoteView - 'PRV.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in PRV.php in PhpRemoteView, possibly 2003-10-23 and earlier, allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
RealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass
RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers t
60RISK
open ↗Exploit-DB✓ VexDay Proof
RealVNC 4.1.0 < 4.1.1 - VNC Null Authentication Bypass (Metasploit)
RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers t
60RISK
open ↗Exploit-DB✓ VexDay Proof
GNUnet 0.7.0d - Empty UDP Packet Remote Denial of Service
GNUnet before SVN revision 2781 allows remote attackers to cause a denial of service (infinite loop and CPU consumption)
23RISK
open ↗Exploit-DB✓ VexDay Proof
freeSSHd 1.0.9 - Key Exchange Algorithm Buffer Overflow
Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other produc
60RISK
open ↗Exploit-DB✓ VexDay Proof
Pixaria PopPhoto 3.5.4 - 'CFG[popphoto_base_path]' Remote File Inclusion
PHP remote file inclusion vulnerability in resources/includes/popp.config.loader.inc.php in PopSoft Digital PopPhoto Stu
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPODP 1.5 - 'ODP.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in phpODP 1.5h allows remote attackers to inject arbitrary web script via the b
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Script Tools PSY Auction - 'email_request.php?user_id' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in email_request.php in PSY Auction allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
DeluxeBB 1.06 - 'name' SQL Injection (mq=off)
SQL injection vulnerability in misc.php in DeluxeBB 1.06 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Confixx 3.0/3.1 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ftplogin/index.php in Confixx 3.1.2 allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
PuTTy.exe 0.53 - Validation Remote Buffer Overflow (Metasploit)
Multiple SSH2 servers and clients do not properly handle large packets or large fields, which may allow remote attackers
60RISK
open ↗Exploit-DB✓ VexDay Proof
RadScripts RadLance 7.0 - 'popup.php' Local File Inclusion
Directory traversal vulnerability in popup.php in RadScripts RadLance Gold 7.0 allows remote attackers to read arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Script Tools PSY Auction - 'item.php?id' SQL Injection
SQL injection vulnerability in item.php in PSY Auction allows remote attackers to execute arbitrary SQL commands via the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java Applet - Font.createFont Remote Denial of Service
Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remo
28RISK
open ↗Exploit-DB✓ VexDay Proof
Empire 4.3.2 - 'strncat' Denial of Service
The client_cmd function in Empire 4.3.2 and earlier allows remote attackers to cause a denial of service (application cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
outgun 1.0.3 bot 2 - Multiple Vulnerabilities
Buffer overflow in the changeRegistration function in servernet.cpp for Outgun 1.0.3 bot 2 and earlier allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
outgun 1.0.3 bot 2 - Multiple Vulnerabilities
The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot 2 and earlier allow remote attackers to cause a denial of s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Genecys 0.2 - Buffer Overflow / NULL Pointer (Denial of Service)
Buffer overflow in the tell_player_surr_changes function in Genecys 0.2 and earlier might allow remote attackers to exec
28RISK
open ↗Exploit-DB✓ VexDay Proof
outgun 1.0.3 bot 2 - Multiple Vulnerabilities
The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot 2 and earlier allow remote attackers to cause a denial of s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Genecys 0.2 - Buffer Overflow / NULL Pointer (Denial of Service)
The parse_command function in Genecys 0.2 and earlier allows remote attackers to cause a denial of service (crash) via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
raydium svn 309 - Multiple Vulnerabilities
The raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote attackers to cause
23RISK
open ↗Exploit-DB✓ VexDay Proof
raydium svn 309 - Multiple Vulnerabilities
Buffer overflow in raydium_network_read function in network.c in Raydium SVN revision 312 and earlier allows remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
raydium svn 309 - Multiple Vulnerabilities
Format string vulnerability in the raydium_log function in console.c in Raydium before SVN revision 310 allows local use
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.