Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,258cataloged exploits
36,019CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,697GitHub PoC 14,455VulnCheck XDB 8,811Nuclei 4,349Metasploit 3,488✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
Cisco CatOS 5.x/6.1/7.3/7.4 - CiscoView HTTP Server Buffer Overflow
Buffer overflow in the embedded HTTP server for Cisco Catalyst switches running CatOS 5.4 through 7.3 allows remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ingenium Learning Management System 5.1/6.1 - Reversible Password Hash
Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords (reversible algorithm), w
23RISK
open ↗Exploit-DB✓ VexDay Proof
TelCondex SimpleWebserver 2.0.6 - Denial of Service
TelCondex SimpleWebServer 2.06.20817 allows remote attackers to cause a denial of service (crash) via a long HTTP GET re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5/6 - Unauthorized Document Object Model Access
Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote att
35RISK
open ↗Exploit-DB✓ VexDay Proof
Polycom 2.2/3.0 - ViaVideo Buffer Overflow
Buffer overflow in the web server of Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Polycom ViaVideo 2.2/3.0 - Denial of Service
The web server for Polycom ViaVideo 2.2 and 3.0 allows remote attackers to cause a denial of service (CPU consumption) b
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4 - 'PHPInfo()' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrar
28RISK
open ↗Exploit-DB✓ VexDay Proof
My Web Server 1.0.1/1.0.2 - GET Denial of Service
MyWebServer LLC MyWebServer 1.0.2 allows remote attackers to cause a denial of service (crash) via a long HTTP request,
23RISK
open ↗Exploit-DB✓ VexDay Proof
KDE 3.0.x - KPF Icon Option File Disclosure
Directory traversal vulnerability in kpf for KDE 3.0.1 through KDE 3.0.3a allows remote attackers to read arbitrary file
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook Express 5.5/6.0 - S/MIME Buffer Overflow
Buffer overflow in the S/MIME Parsing capability in Microsoft Outlook Express 5.5 and 6.0 allows remote attackers to exe
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHPBBMod 1.3.3 - PHPInfo Information Disclosure
phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environme
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHPRank 1.8 - 'add.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in phpRank 1.8 allows remote attackers to inject arbitrary web script or HTML v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Content Management Server 2001 - Cross-Site Scripting
Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS) 2001 a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Authoria HR Suite - 'AthCGI.exe' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/NT 4.0 - NetDDE Privilege Escalation (2)
NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/NT 4.0 - NetDDE Privilege Escalation (1)
NetDDE Agent on Windows NT 4.0, 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute
23RISK
open ↗Exploit-DB✓ VexDay Proof
SurfControl SuperScout Email Filter 3.5 - User Credential Disclosure
The administrative web interface (STEMWADM) for SurfControl SuperScout Email Filter allows users to obtain usernames and
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sendmail 8.12.6 - Compromised Source Backdoor
A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such
35RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec Norton Personal Firewall 2002/Kaspersky Labs Anti-Hacker 1.0/BlackIce Server Protection 3.5/BlackICE Defender 2.9 - Auto Block Denial of Service
Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP a
23RISK
open ↗Exploit-DB✓ VexDay Proof
SurfControl SuperScout Email Filter 3.5 - 'MsgError.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in msgError.asp for the administrative web interface (STEMWADM) for SurfControl
23RISK
open ↗Exploit-DB✓ VexDay Proof
SSGBook 1.0 - Image Tag HTML Injection
Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
ghttpd 1.4.x - 'Log()' Remote Buffer Overflow
Buffer overflows in GazTek ghttpd 1.4 allows a remote attacker to execute arbitrary code via long arguments that are pas
28RISK
open ↗Exploit-DB✓ VexDay Proof
Killer Protection 1.0 - Information Disclosure
Killer Protection 1.0 stores the vars.inc include file under the web root with insufficient access control, which allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/2000/NT 4.0 - Help Facility ActiveX Control Buffer Overflow
Buffer overflow in the HTML Help ActiveX Control (hhctrl.ocx) in Microsoft Windows 98, 98 Second Edition, Millennium Edi
35RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 9i Application Server 9.0.2 Web Cache Administration Tool - Denial of Service
The administration module for Oracle Web Cache in Oracle9iAS (9i Application Suite) 9.0.2 allows remote attackers to cau
28RISK
open ↗Exploit-DB✓ VexDay Proof
ATP HTTPd 0.4 - Single Byte Buffer Overflow
Off-by-one buffer overflow in the sock_gets function in sockhelp.c for ATPhttpd 0.4b and earlier allows remote attackers
48RISK
open ↗Exploit-DB✓ VexDay Proof
Cooolsoft PowerFTP Server 2.x - Remote Denial of Service (3)
Buffer overflow in PowerFTP FTP server 2.24, and possibly other versions, allows remote attackers to cause a denial of s
28RISK
open ↗Exploit-DB✓ VexDay Proof
Cooolsoft PowerFTP Server 2.x - Remote Denial of Service (1)
Buffer overflow in PowerFTP FTP server 2.24, and possibly other versions, allows remote attackers to cause a denial of s
28RISK
open ↗Exploit-DB✓ VexDay Proof
Cooolsoft PowerFTP Server 2.x - Remote Denial of Service (2)
Buffer overflow in PowerFTP FTP server 2.24, and possibly other versions, allows remote attackers to cause a denial of s
28RISK
open ↗Exploit-DB✓ VexDay Proof
phpLinkat 0.1 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in (1) showcat.php and (2) addyoursite.php in phpLinkat 0.1.0 allows remote att
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.