Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,008cataloged exploits
35,919CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,640GitHub PoC 14,377VulnCheck XDB 8,722Nuclei 4,333Metasploit 3,478✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
Fool's Workshop Owl's Workshop 1.0 - 'newmultiplechoice.php' Arbitrary File Access
Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fool's Workshop Owl's Workshop 1.0 - '/glossaries/index.php?File' Arbitrary File Access
OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossa
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linksys WAP55AG 1.0.7 - SNMP Community String Insecure Configuration
Linksys WAP55AG 1.07 allows remote attackers with access to an SNMP read only community string to gain access to read/wr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fool's Workshop Owl's Workshop 1.0 - 'readings/index.php' Arbitrary File Access
OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossa
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fool's Workshop Owl's Workshop 1.0 - 'resultsignore.php' Arbitrary File Access
OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossa
23RISK
open ↗Exploit-DB✓ VexDay Proof
eCommerce Corporation Online Store Kit 3.0 - 'shop.php?cat' SQL Injection
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorize
23RISK
open ↗Exploit-DB✓ VexDay Proof
eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection
SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorize
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fool's Workshop Owl's Workshop 1.0 - 'multiplechoice/index.php' Arbitrary File Access
Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not prop
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fool's Workshop Owl's Workshop 1.0 - 'glossary.php' Arbitrary File Access
Directory traversal vulnerability in OWLS 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the
23RISK
open ↗Exploit-DB✓ VexDay Proof
Metamail 2.7 - Multiple Buffer Overflow / Format String Handling Vulnerabilities
Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.
28RISK
open ↗Exploit-DB✓ VexDay Proof
TransSoft Broker FTP Server 6.1 - Denial of Service
TsFtpSrv.exe in Broker FTP 6.1.0.0 allows remote attackers to cause a denial of service (CPU consumption) via an open id
23RISK
open ↗Exploit-DB✓ VexDay Proof
SmallFTPd 1.0.3 - Remote Denial of Service
Buffer overflow in smallftpd 0.99 allows local users to cause a denial of service (crash) via an FTP request with a larg
23RISK
open ↗Exploit-DB✓ VexDay Proof
AllMyVisitors 0.x - 'info.inc.php' Arbitrary Code Execution
PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyG
23RISK
open ↗Exploit-DB✓ VexDay Proof
ShopCartCGI 2.3 - genindexpage.cgi Traversal Arbitrary File Access
Directory traversal vulnerability in ShopCartCGI 2.3 allows remote attackers to retrieve arbitrary files via a .. (dot d
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProductCart 1.x/2.x - Weak Cryptography
EarlyImpact ProductCart uses a weak encryption scheme to encrypt passwords, which allows remote attackers to obtain the
23RISK
open ↗Exploit-DB✓ VexDay Proof
AllMyLinks 0.x - 'footer.inc.php' Arbitrary Code Execution
PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyG
23RISK
open ↗Exploit-DB✓ VexDay Proof
ShopCartCGI 2.3 - 'gotopage.cgi' Traversal Arbitrary File Access
Directory traversal vulnerability in ShopCartCGI 2.3 allows remote attackers to retrieve arbitrary files via a .. (dot d
23RISK
open ↗Exploit-DB✓ VexDay Proof
Freeform Interactive Purge 1.4.7/Purge Jihad 2.0.1 Game Client - Remote Buffer Overflow
Buffer overflow in Purge Jihad 2.0.1 and earlier allows remote game servers to execute arbitrary code via an information
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProductCart 1.x/2.x - 'advSearch_h.asp' Multiple SQL Injections
Multiple SQL injection vulnerabilities in ProductCart 2.7 allow remote attackers to execute arbitrary SQL commands via (
23RISK
open ↗Exploit-DB✓ VexDay Proof
AllMyGuests 0.x - 'info.inc.php' Arbitrary Code Execution
PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyG
23RISK
open ↗Exploit-DB✓ VexDay Proof
Xlight FTP Server 1.52 - Remote Send File Request Denial of Service
Xlight FTP server 1.52 allows remote authenticated users to cause a denial of service (crash) via a RETR command with a
23RISK
open ↗Exploit-DB✓ VexDay Proof
RobotFTP Server 1.0/2.0 - 'Username' Buffer Overflow (2)
Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProductCart 1.x/2.x - 'Custva.asp?redirectUrl' Cross-Site Scripting
Multiple SQL injection vulnerabilities in ProductCart 2.7 allow remote attackers to execute arbitrary SQL commands via (
23RISK
open ↗Exploit-DB✓ VexDay Proof
ACLogic CesarFTP 0.99 - Remote Resource Exhaustion (Denial of Service)
CesarFTP 0.99e allows remote attackers to cause a denial of service (CPU consumption) via a long RETR parameter.
23RISK
open ↗Exploit-DB✓ VexDay Proof
YABB SE 1.5 - 'Quote' SQL Injection
SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords v
23RISK
open ↗Exploit-DB✓ VexDay Proof
RobotFTP Server 1.0/2.0 - 'Username' Buffer Overflow (1)
Buffer overflow in RobotFTP 1.0 and 2.0 beta 1 allows remote attackers to cause a denial of service (crash) and possibly
23RISK
open ↗Exploit-DB✓ VexDay Proof
CitrusDB 0.3.6 - Remote Authentication Bypass
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - ASN.1 'LSASS.exe' Remote Denial of Service (MS04-007)
Multiple integer overflows in Microsoft ASN.1 library (MSASN1.DLL), as used in LSASS.EXE, CRYPT32.DLL, and other Microso
60RISK
open ↗Exploit-DB✓ VexDay Proof
KarjaSoft Sami HTTP Server 1.0.4 - GET Buffer Overflow
Buffer overflow in KarjaSoft Sami HTTP Server 1.0.4 allows remote attackers to cause a denial of service (crash) and pos
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.