Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,866cataloged exploits
35,812CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
CA BrightStor ARCserve Backup - Remote Buffer Overflow (PoC)
Buffer overflow in the Discovery Service in BrightStor ARCserve Backup 9.0 through 11.1 allows remote attackers to execu
60RISK
open ↗Exploit-DB✓ VexDay Proof
Quake 3 Engine - Infostring Crash and Shutdown
The Quake 3 engine, as used in multiple game packages, allows remote attackers to cause a denial of service (shutdown ga
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyPHP Forum 1.0 - SQL Injection
Multiple SQL injection vulnerabilities in MyPHP Forum 1.0 allow remote attackers to execute arbitrary SQL commands via (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Armagetron Advanced 0.2.7.0 - Server Crash
Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 and earlier allow remote attackers to cause a denial of s
23RISK
open ↗Exploit-DB✓ VexDay Proof
CMScore - SQL Injection
Multiple SQL injection vulnerabilities in CMScore allow remote attackers to execute arbitrary SQL commands via the (1) E
23RISK
open ↗Exploit-DB✓ VexDay Proof
Armagetron Advanced 0.2.7.0 - Server Crash
Armagetron 0.2.6.0 and earlier and Armagetron Advanced 0.2.7.0 earlier allows remote attackers to cause a denial of serv
33RISK
open ↗Exploit-DB✓ VexDay Proof
ELOG 2.5.6 - Remote Shell
Buffer overflow in the decode_post function in ELOG before 2.5.7 allows remote attackers to execute arbitrary code via a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Prozilla 1.3.7.3 - Remote Format String
Format string vulnerability in ProZilla 1.3.7.3 and earlier allows remote attackers to execute arbitrary code via format
23RISK
open ↗Exploit-DB✓ VexDay Proof
DelphiTurk FTP 1.0 - Passwords to Local Users
DelphiTurk FTP 1.0 stores usernames and passwords in the profile.dat file, which allows local users to gain privileges.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX - AppleFileServer Remote Denial of Service
Integer signedness error in Apple File Service (AFP Server) allows remote attackers to cause a denial of service (applic
23RISK
open ↗Exploit-DB✓ VexDay Proof
Software602 602 Lan Suite 2004 2004.0.04.1221 - Arbitrary File Upload
Directory traversal vulnerability in 602LAN SUITE 2004.0.04.1221 allows remote authenticated users to upload and execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure
viewthread.php in php-fusion 4.x does not check the (1) forum_id or (2) forum_cat parameters, which allows remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
DelphiTurk CodeBank 3.1 - Local Username and Password Disclosure
DelphiTurk CodeBank (aka KodBank) 3.1 and earlier stores usernames and passwords in the Codebank registry key, which all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MSN Messenger 6.2.0137 - '.png' Remote Buffer Overflow
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute a
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook 2003 - Web Access Login Form Remote URI redirection
Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs
28RISK
open ↗Exploit-DB✓ VexDay Proof
Setuid perl - 'PerlIO_Debug()' Local Overflow
Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local use
23RISK
open ↗Exploit-DB✓ VexDay Proof
Foxmail 2.0 - 'MAIL FROM:' Denial of Service
Buffer overflow in Foxmail 2.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code
23RISK
open ↗Exploit-DB✓ VexDay Proof
Foxmail 2.0 - 'MAIL FROM:' Denial of Service
Format string vulnerability in Foxmail Server 2.0 allows remote attackers to cause a denial of service (crash) and possi
23RISK
open ↗Exploit-DB✓ VexDay Proof
3CServer 1.1 (FTP Server) - Remote Overflow
Multiple heap-based buffer overflows in 3Com 3CServer allow remote authenticated users to execute arbitrary code via lon
23RISK
open ↗Exploit-DB✓ VexDay Proof
Setuid perl - 'PerlIO_Debug()' Root Owned File Creation Privilege Escalation
The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX - '.DS_Store' Arbitrary File Overwrite
The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a har
23RISK
open ↗Exploit-DB✓ VexDay Proof
PerlDesk 1.x - SQL Injection
SQL injection vulnerability in PerlDesk 1.x allows remote attackers to inject arbitrary SQL commands via the view parame
23RISK
open ↗Exploit-DB✓ VexDay Proof
Operator Shell (osh) 1.7-12 - Local Privilege Escalation
Buffer overflow in OSH before 1.7-15 allows local users to execute arbitrary code via a long current working directory a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Savant Web Server 3.1 (Windows 2003) - Remote Buffer Overflow
Buffer overflow in Savant Web Server 3.1 allows remote attackers to execute arbitrary code via a long HTTP request.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Newspost 2.1 - 'socket_getline()' Remote Buffer Overflow (2)
Buffer overflow in the socket_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to exe
28RISK
open ↗Exploit-DB✓ VexDay Proof
ngIRCd 0.8.2 - Remote Format String
Format string vulnerability in the Log_Resolver function in log.c for ngIRCd 0.8.2 and earlier, when compiled with IDENT
23RISK
open ↗Exploit-DB✓ VexDay Proof
Painkiller 1.35 - in-game cd-key alpha-numeric Buffer Overflow (PoC)
Buffer overflow in Painkiller 1.35 and earlier, and possibly other versions before 1.61, allows remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS 5.0 - '.printer' ISAPI Extension Buffer Overflow (3)
Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via
60RISK
open ↗Exploit-DB✓ VexDay Proof
PostgreSQL 7.x - Multiple Vulnerabilities
Buffer overflow in gram.y for PostgreSQL 8.0.0 and earlier may allow attackers to execute arbitrary code via a large num
28RISK
open ↗Exploit-DB✓ VexDay Proof
Newspost 2.0/2.1 - Remote Buffer Overflow
Buffer overflow in the socket_getline function in Newspost 2.1.1 and earlier allows remote malicious NNTP servers to exe
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.