Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,866cataloged exploits
35,812CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
pntresmailer 6.0 - Directory Traversal
Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alex Heiphetz Group eZshopper - 'loadpage.cgi' Directory Traversal
EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
InShop and InMail - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in inmail.pl in Insite Inmail allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable Mail Server IMAP 1.52 - Remote Buffer Overflow
Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote at
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.4.x/2.6.x - Local Denial of Service / Memory Disclosure
The binfmt functionality in the Linux kernel, when "memory overcommit" is enabled, allows local users to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zwiki 0.10/0.36.2 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in standard_error_message.dtml for Zwiki after 0.10.0rc1 to 0.36.2 allows remot
23RISK
open ↗Exploit-DB✓ VexDay Proof
Star Wars Battlefront 1.1 - Fake Players Denial of Service
Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a jo
23RISK
open ↗Exploit-DB✓ VexDay Proof
KorWeblog 1.6.2 - Remote Directory Listing
Directory traversal vulnerability in viewimg.php in KorWeblog 1.6.2-cvs and earlier allows remote attackers to list arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Star Wars Battlefront 1.1 - Fake Players Denial of Service
Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (applicat
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jabber Server 2.0 - Multiple Remote Buffer Overflow Vulnerabilities
Buffer overflow in the C2S module in the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a deni
28RISK
open ↗Exploit-DB✓ VexDay Proof
Winamp 5.06 - 'IN_CDDA.dll' Remote Buffer Overflow
Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions including 5.06, allows remote att
28RISK
open ↗Exploit-DB✓ VexDay Proof
Open DC Hub 0.7.14 - Remote Buffer Overflow
Buffer overflow in Open Dc Hub 0.7.14 allows remote attackers, with administrator privileges, to execute arbitrary code
28RISK
open ↗Exploit-DB✓ VexDay Proof
SugarCRM 1.x/2.0 Module - 'record' SQL Injection
SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
SugarCRM 1.x/2.0 Module - Traversal Arbitrary File Access
Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary f
23RISK
open ↗Exploit-DB✓ VexDay Proof
Prozilla 1.3.6 - Remote Stack Overflow
Multiple buffer overflows in (1) http.c, (2) http-retr.c, (3) main.c and other code that handles network protocols in Pr
28RISK
open ↗Exploit-DB✓ VexDay Proof
Soldier of Fortune II 1.3 Server/Client - Denial of Service
Buffer overflow in Soldier of Fortune II 1.03 Gold and earlier allows remote attackers to cause a denial of service (ser
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpBB 2.0.10 - Remote Command Execution
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrase
60RISK
open ↗Exploit-DB✓ VexDay Proof
ZYXEL 3 Prestige Router - HTTP Remote Administration Configuration Reset
ZyXEL Prestige 623, 650, and 652 HW Routers, and possibly other versions, with HTTP Remote Administration enabled, does
23RISK
open ↗Exploit-DB✓ VexDay Proof
wodFtpDLX Client - ActiveX Control Buffer Overflow Crash
Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before 2.3.2.97, as used by CoffeeCup Direct FTP 6.2.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Halo 1.05 - Broadcast Client Crash
Halo: Combat Evolved 1.05 and earlier allows remote game servers to cause a denial of service (client crash) via a long
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass
The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, do
28RISK
open ↗Exploit-DB✓ VexDay Proof
CoffeeCup FTP Clients (Direct 6.2.0.62) (Free 3.0.0.10) - Remote Buffer Overflow
Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before 2.3.2.97, as used by CoffeeCup Direct FTP 6.2.
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPKIT 1.6 - Multiple Input Validation Vulnerabilities
Cross-site scripting (XSS) vulnerability in popup.php in PHPKIT 1.6.03 through 1.6.1 allows remote attackers to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
Invision Power Board 2.0.0 < 2.0.2 - SQL Injection
SQL injection vulnerability in post.php in Invision Power Board (IPB) 2.0.0 through 2.0.2 allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x - IPTables Logging Rules Integer Underflow Remote (PoC)
Integer underflow in the firewall logging rules for iptables in Linux before 2.6.8 allows remote attackers to cause a de
28RISK
open ↗Exploit-DB✓ VexDay Proof
DMS POP3 Server 1.5.3 build 37 - Remote Buffer Overflow
Buffer overflow in pop3svr.exe for DMS POP3 1.5.3.27 and earlier allows remote attackers to cause a denial of service (s
23RISK
open ↗Exploit-DB✓ VexDay Proof
TWiki 20030201 - 'search.pm' Remote Command Execution
The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in
50RISK
open ↗Exploit-DB✓ VexDay Proof
IPBProArcade 2.5 - SQL Injection
SQL injection vulnerability in index.php in the ibProArcade module for Invision Power Board (IPB) 1.x and 2.x allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Altiris Deployment Solution 5.6 - Client Service Privilege Escalation
The Altiris Client Service for Windows (ACLIENT.EXE) 6.0.88 allows local users to disable password protection and access
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 6.0 SP2 - File Download Security Warning Bypass
Internet Explorer 5.5 and 6.0 allows remote attackers to cause the File Download dialogue box to misrepresent the name o
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.