Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,866cataloged exploits
35,812CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
Ultrix 4.5/MIPS - dxterm 0 Local Buffer Overflow
Buffer overflow in dxterm in Ultrix 4.5 allows local users to execute arbitrary code via a long -setup parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM AIX 5.x - 'Diag' Local Privilege Escalation
Untrusted execution path vulnerability in the diag commands (1) lsmcode, (2) diag_exec, (3) invscout, and (4) invscoutd
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 9.0 - ActiveX Control File Enumeration
The getItemInfoByAtom function in the ActiveX control for Microsoft Windows Media Player 9.0 returns a 0 if the file doe
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kayako eSupport 2.x - 'index.php' Knowledgebase Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 2.x allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 9.0 - ActiveX Control Media File Attribute Corruption
The Microsoft Windows Media Player 9.0 ActiveX control may allow remote attackers to execute arbitrary web script in the
28RISK
open ↗Exploit-DB✓ VexDay Proof
Kayako eSupport 2.x - Ticket System Multiple SQL Injections
Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Gadu-Gadu 6.0 - URL Parser JavaScript Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Gadu-Gadu build 155 and earlier allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
O3Read 0.0.3 - HTML Parser Buffer Overflow
Buffer overflow in the parse_html function in o3read.c for o3read 0.0.3 allows remote attackers to execute arbitrary cod
28RISK
open ↗Exploit-DB✓ VexDay Proof
IkonBoard 3.x - Multiple SQL Injections
SQL injection vulnerability in ikonboard.cgi in Ikonboard 3.1.0 through 3.1.3 allows remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
WinRAR 3.4.1 - Corrupt '.ZIP' File
WinRAR 3.40, and possibly earlier versions, allows remote attackers to execute arbitrary code via a ZIP file containing
28RISK
open ↗Exploit-DB✓ VexDay Proof
XLReader 0.9 - Remote Client-Side Buffer Overflow
Buffer overflow in the book_format_sql function in format.c for xlreader 0.9.0 allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.4.28/2.6.9 - 'ip_options_get' Local Overflow
Memory leak in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of ser
23RISK
open ↗Exploit-DB✓ VexDay Proof
Xine-Lib 0.9/1 - Remote Client-Side Buffer Overflow
Buffer overflow in the open_aiff_file function in demux_aiff.c for xine-lib (libxine) 1-rc7 allows remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.4.28/2.6.9 - vc_resize int Local Overflow
Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a d
23RISK
open ↗Exploit-DB✓ VexDay Proof
MediaWiki 1.3.x - Arbitrary Script Upload
MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, su
23RISK
open ↗Exploit-DB✓ VexDay Proof
RTF2LATEX2E 1.0 - Remote Stack Buffer Overflow
Buffer overflow in the ReadFontTbl function in reader.c for rtf2latex2e 1.0fc2 allows remote attackers to execute arbitr
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4/5 - 'addslashes()' Null Byte Bypass
The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
QwikMail 0.3 - 'HELO' Buffer Overflow (PoC)
Buffer overflow in qwik-smtpd allows remote attackers to use the server as an SMTP spam relay via a long HELO command, w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vilistextum 2.6.6 - HTML Attribute Parsing Buffer Overflow
Buffer overflow in the get_attr function in html.c for vilistextum 2.6.6 allows remote attackers to execute arbitrary co
28RISK
open ↗Exploit-DB✓ VexDay Proof
IWebNegar - Multiple SQL Injections
SQL injection vulnerability in iWebNegar allows remote attackers to execute arbitrary SQL commands via (1) the string pa
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpGroupWare 0.9.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in phpGroupWare 0.9.16.003 and earlier allow remote attackers to inj
23RISK
open ↗Exploit-DB✓ VexDay Proof
MPG123 0.59 - Find Next File Remote Client-Side Buffer Overflow
Buffer overflow in the find_next_file function in playlist.c for mpg123 0.59r allows remote attackers to execute arbitra
28RISK
open ↗Exploit-DB✓ VexDay Proof
Yanf 0.4 - HTTP Response Buffer Overflow
Buffer overflow in the get function in get.c for Yanf 0.4 allows remote malicious web servers to execute arbitrary code
23RISK
open ↗Exploit-DB✓ VexDay Proof
PCAL 4.x - Calendar File 'get_holiday' Remote Buffer Overflow
Multiple buffer overflows in (1) the getline function in pcalutil.c and (2) the get_holiday function in readfile.c for p
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 3/4/5 - Multiple Local/Remote Vulnerabilities (1)
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial o
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 3/4/5 - Multiple Local/Remote Vulnerabilities (2)
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial o
28RISK
open ↗Exploit-DB✓ VexDay Proof
PCAL 4.x - Calendar File 'getline' Remote Buffer Overflow
Multiple buffer overflows in (1) the getline function in pcalutil.c and (2) the get_holiday function in readfile.c for p
28RISK
open ↗Exploit-DB✓ VexDay Proof
CUPS 1.1.x - '.HPGL' File Processor Buffer Overflow
Buffer overflow in the ParseCommand function in hpgl-input.c in the hpgltops program for CUPS 1.1.22 allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
abctab2ps 1.6.3 - 'Write_Heading' '.ABC' Remote Buffer Overflow
Multiple buffer overflows in the (1) write_heading function in subs.cpp or (2) trim_title function in parse.cpp for abct
28RISK
open ↗Exploit-DB✓ VexDay Proof
phpGroupWare 0.9.x - 'index.php' Multiple SQL Injections
phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpected characters
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.