Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
AzDGDatingLite 2.1.1 - 'index.php?language' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in AzDGDatingLite 2.1.1 allows remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mcafee FreeScan CoMcFreeScan Browser - Object Buffer Overflow (PoC)
Mcafee FreeScan allows remote attackers to cause a denial of service and possibly arbitrary code via a long string in th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mcafee FreeScan CoMcFreeScan Browser - Information Disclosure
McFreeScan.CoMcFreeScan.1 ActiveX object in Mcafee FreeScan allows remote attackers to obtain sensitive information via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kerio Personal Firewall 4.0.x - Web Filtering Remote Denial of Service
The Web Filtering functionality in Kerio Personal Firewall (KPF) 4.0.13 allows remote attackers to cause a denial of ser
23RISK
open ↗Exploit-DB✓ VexDay Proof
AzDGDatingLite 2.1.1 - 'view.php?id' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in AzDGDatingLite 2.1.1 allows remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec Security Check Virus Detection - COM Object Denial of Service
rufsi.dll in Symantec Virus Detection allows remote attackers to cause a denial of service (crash) via a long string to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blaxxun Contact 3D - X-CC3D Browser Object Buffer Overflow (PoC)
Buffer overflow in blaxxun 3D 7.0 allows remote attackers to execute arbitrary code via a long URL property inside an ob
23RISK
open ↗Exploit-DB✓ VexDay Proof
Panda ActiveScan 5.0 - 'ascontrol.dll' Remote Heap Overflow
Buffer overflow in ascontrol.dll in Panda ActiveScan 5.0 allows remote attackers to execute arbitrary code via the Inter
23RISK
open ↗Exploit-DB✓ VexDay Proof
ada imgsvr 0.4 - Directory Traversal
Directory traversal vulnerability in ADA Image Server (ImgSvr) 0.4 allows remote attackers to read arbitrary files or li
23RISK
open ↗Exploit-DB✓ VexDay Proof
tcpdump - ISAKMP Identification Payload Integer Overflow
Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of serv
35RISK
open ↗Exploit-DB✓ VexDay Proof
Aborior Encore Web Forum - Arbitrary Command Execution
display.cgi in Aborior Encore WebForum allows remote to execute arbitrary commands via shell metacharacters in the file
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Vista - ARP Table Entries Denial of Service
Microsoft Windows XP and Vista overwrites ARP table entries included in gratuitous ARP, which allows remote attackers to
28RISK
open ↗Exploit-DB✓ VexDay Proof
ADA IMGSVR 0.4 - Remote Directory Listing
Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a t
23RISK
open ↗Exploit-DB✓ VexDay Proof
ADA IMGSVR 0.4 - Arbitrary File Download
Ada Image Server (ImgSvr) 0.4 allows remote attackers to view directories or download files via an HTTP request with a t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Roger Wilco Server 1.4.1 - UDP Datagram Handling Denial of Service
Roger Wilco 1.4.1.6 and earlier or Roger Wilco Base Station 0.30a and earlier allows remote attackers to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
Roger Wilco Server 1.4.1 - Unauthorized Audio Stream Denial of Service
Roger Wilco 1.4.1.6 and earlier, or Roger Wilco Base Station 0.30a or earlier, allows remote attackers to send audio to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cactusoft CactuShop 5.0/5.1 - SQL Injection
SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
CactuSoft CactuShop 5.0/5.1 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
LinBit Technologies LINBOX Officeserver - Remote Authentication Bypass
LINBOX LIN:BOX allows remote attackers to bypass authentication, obtain sensitive information, or gain access via a dire
23RISK
open ↗Exploit-DB✓ VexDay Proof
MPlayer 0.9/1.0 - Remote HTTP Header Buffer Overflow
Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute ar
28RISK
open ↗Exploit-DB✓ VexDay Proof
Interchange 4.8.x/5.0 - Remote Information Disclosure
Interchange before 5.0.1 allows remote attackers to "expose the content of arbitrary variables" and read or modify sensi
23RISK
open ↗Exploit-DB✓ VexDay Proof
PhotoPost PHP Pro 3.x/4.x - 'showgallery.php' Multiple SQL Injections
Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' pass
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fresh Guest Book 1.0/2.x - HTML Injection
Cross-site scripting (XSS) vulnerability in guest.cgi in Fresh Guest Book allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebCT Campus Edition 3.8/4.x - HTML Injection
Cross-site scripting (XSS) vulnerability in WebCT Campus Edition 4.1.1.5 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (2)
SQL injection vulnerability in category.asp in A-CART Pro and A-CART 2.0 allows remote attackers to gain privileges via
23RISK
open ↗Exploit-DB
PhotoPost < 4.6 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to inj
23RISK
open ↗Exploit-DB
PhotoPost < 4.6 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in PhotoPost PHP Pro 4.6.x and earlier allow remote attackers to gain users' pass
23RISK
open ↗Exploit-DB✓ VexDay Proof
RealSecure / Blackice - 'iss_pam1.dll' Remote Overflow
Multiple stack-based buffer overflows in the ICQ parsing routines of the ISS Protocol Analysis Module (PAM) component, a
60RISK
open ↗Exploit-DB✓ VexDay Proof
Ethereal 0.10.0 < 0.10.2 - IGAP Overflow
Multiple buffer overflows in Ethereal 0.8.13 to 0.10.2 allow remote attackers to cause a denial of service and possibly
35RISK
open ↗Exploit-DB✓ VexDay Proof
eSignal 7.6 - STREAMQUOTE Remote Buffer Overflow
Stack-based buffer overflow in WinSig.exe in eSignal 7.5 and 7.6 allows remote attackers to execute arbitrary code via a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.