Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
Pegasi Web Server 0.2.2 - Arbitrary File Access
Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the
23RISK
open ↗Exploit-DB✓ VexDay Proof
cPanel 5/6/7/8/9 - Resetpass Remote Command Execution
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x,
35RISK
open ↗Exploit-DB✓ VexDay Proof
Pegasi Web Server 0.2.2 - Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Epic Games Unreal Tournament Server 436.0 - Engine Remote Format String
Format string vulnerability in games using the Epic Games Unreal Engine 436 allows remote attackers to cause a denial of
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 1.x - Cookie Directory Traversal
Apple Safari allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e%2e" (en
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook 2002 - 'Mailto' Quoting Zone Bypass
Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when
35RISK
open ↗Exploit-DB✓ VexDay Proof
PWebServer 0.3.x - Directory Traversal
Directory traversal vulnerability in PWebServer 0.3.3 allows remote attackers to read arbitrary files via a .. (dot dot)
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 1.x - Large JavaScript Array Handling Denial of Service
The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault
23RISK
open ↗Exploit-DB✓ VexDay Proof
VirtuaSystems VirtuaNews 1.0.x (Multiple Modules) - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Multiple Vendor - TCP Sequence Number Approximation (1)
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial o
45RISK
open ↗Exploit-DB✓ VexDay Proof
Red Faction 1.20 - Server Reply Remote Buffer Overflow (PoC)
Buffer overflow in Red Faction client 1.20 and earlier allows remote servers to execute arbitrary code via a long server
23RISK
open ↗Exploit-DB✓ VexDay Proof
Age of Sail II 1.04.151 - Remote Buffer Overflow
Buffer overflow in Privateer's Bounty: Age of Sail II allows remote attackers to execute arbitrary code via a long nickn
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alpha Black Zero 1.04 - Remote Denial of Service
The Serious engine, as used in (1) Alpha Black Zero Intrepid Protocol 1.04 and earlier, (2) Nitro family, and (3) Seriou
23RISK
open ↗Exploit-DB✓ VexDay Proof
AppleFileServer 10.3.3 (OSX) - LoginEXT PathName Overflow (Metasploit)
Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitr
50RISK
open ↗Exploit-DB✓ VexDay Proof
SpiderSales 2.0 Shopping Cart - Multiple Vulnerabilities
SQL injection vulnerability in viewCart.asp in SpiderSales shopping cart software allows remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
1st Class Internet Solutions 1st Class Mail Server 4.0 - Remote Buffer Overflow (PoC)
Buffer overflow in the POP3 server in 1st Class Mail Server 4.0 allows remote attackers to cause a denial of service (cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nortel Wireless LAN Access Point 2200 Series - Denial of Service
Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (s
28RISK
open ↗Exploit-DB✓ VexDay Proof
YaBB SE 1.5.x - Multiple SQL Injections
Multiple SQL injection vulnerabilities in YaBB SE 1.5.4 through 1.5.5b allow remote attackers to execute arbitrary SQL v
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Anubis 3.6.x/3.9.x - Multiple Format String Vulnerabilities
Multiple format string vulnerabilities in GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow remote attackers to ex
28RISK
open ↗Exploit-DB✓ VexDay Proof
YaBB SE 1.5.x - Arbitrary File Deletion
Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete
23RISK
open ↗Exploit-DB✓ VexDay Proof
Software602 602Pro LAN Suite - Web Mail Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in LAN SUITE Web Mail 602Pro allows remote attackers to execute arbitrary scrip
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chatman 1.5.1 RC1 - Broadcast Crash
Chatman 1.1.1 RC1 and earlier allows remote attackers to cause a denial of service (memory consumption or application cr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not prop
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Anubis 3.6.x/3.9.x - 'auth.c auth_ident()' Remote Overflow
Multiple buffer overflows in auth_ident() function in auth.c for GNU Anubis 3.6.0 through 3.6.2, 3.9.92 and 3.9.93 allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Squid Proxy 2.4/2.5 - NULL URL Character Unauthorized Access
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a U
28RISK
open ↗Exploit-DB✓ VexDay Proof
WFTPD Server 3.21 - Remote Buffer Overflow
Stack-based buffer overflow in WFTPD Pro Server 3.21 Release 1, Pro Server 3.20 Release 2, Server 3.21 Release 1, and Se
23RISK
open ↗Exploit-DB✓ VexDay Proof
IPSwitch IMail LDAP Daemon/Service - Remote Buffer Overflow
Buffer overflow in the Lightweight Directory Access Protocol (LDAP) daemon (iLDAP.exe 3.9.15.10) in Ipswitch IMail Serve
50RISK
open ↗Exploit-DB✓ VexDay Proof
ArGoSoft FTP Server 1.0/1.2/1.4 - Multiple Vulnerabilities
ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to cause a denial of service (crash) via a SITE PAS
23RISK
open ↗Exploit-DB✓ VexDay Proof
RhinoSoft Serv-U FTPd Server 3.x/4.x/5.x - 'MDTM' Remote Overflow
Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code via a long time
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5/6 - Cross-Domain Event Leakage
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and cap
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.