Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,258cataloged exploits
36,019CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,697GitHub PoC 14,455VulnCheck XDB 8,811Nuclei 4,349Metasploit 3,488✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
Imatix Xitami 2.5 - GSL Template Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Errors.gsl in Imatix Xitami 2.5b4 and 2.5b5 allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ruslan Communications <Body>Builder - Authentication Bypass
SQL injection vulnerability in Ruslan <Body>Builder allows remote attackers to gain administrative privileges via a "'--
23RISK
open ↗Exploit-DB✓ VexDay Proof
Working Resources 1.7.3 BadBlue - Null Byte File Disclosure
BadBlue server allows remote attackers to read restricted files, such as EXT.INI, via an HTTP request that contains a he
23RISK
open ↗Exploit-DB✓ VexDay Proof
ColdFusion MX - Missing Template Cross-Site Scripting
Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attac
28RISK
open ↗Exploit-DB✓ VexDay Proof
AnalogX SimpleServer:WWW 1.16 - Web Server Buffer Overflow
Buffer overflow in AnalogX SimpleServer:WWW 1.16 and earlier allows remote attackers to cause a denial of service (crash
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netscape 4.77 - Composer Font Face Field Buffer Overflow
Buffer overflow in Composer in Netscape 4.77 allows local users to overwrite process memory and execute arbitrary code v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server 2000 - 'SQLXML' Buffer Overflow (PoC)
Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary
35RISK
open ↗Exploit-DB✓ VexDay Proof
Macromedia JRun 3/4 JSP Engine - Denial of Service
The Java Server Pages (JSP) engine in JRun allows web page owners to cause a denial of service (engine crash) on the web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ayman Akt IRCIT 0.3.1 - Invite Message Remote Buffer Overflow
Buffer overflow in IRCIT 0.3.1 IRC client allows remote attackers to execute arbitrary code via a long invite request.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server 2000 - SQLXML Script Injection
Cross-site scripting vulnerability in the SQLXML component of Microsoft SQL Server 2000 allows an attacker to execute ar
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 3/4 - JSP Engine Denial of Service
The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the w
28RISK
open ↗Exploit-DB✓ VexDay Proof
Netscape 4.x/6.x / Mozilla 0.9.x - Malformed Email POP3 Denial of Service
The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to c
23RISK
open ↗Exploit-DB✓ VexDay Proof
MakeBook 2.2 - Form Field Input Validation
Scripts For Educators MakeBook 2.2 CGI program allows remote attackers to execute script as other visitors, or execute s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Richard Gooch SimpleInit 2.0.2 - Open File Descriptor
simpleinit on Linux systems does not close a read/write FIFO file descriptor before creating a child process, which allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
CGIScript.net csNews 1.0 - Header File Type Restriction Bypass
CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files, and possibly gain privileges, via th
23RISK
open ↗Exploit-DB✓ VexDay Proof
CGIScript.net csNews 1.0 - Double URL Encoding Unauthorized Administrative Access
CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to (1) defaul
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyHelpDesk 20020509 - HTML Injection
Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyHelpDesk 20020509 - Cross-Site Scripting
Cross-site scripting vulnerabilities in MyHelpDesk 20020509, and possibly other versions, allows remote attackers to exe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Geeklog 1.3.5 - Calendar Event Form Script Injection
Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Geeklog 1.3.5 - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via
23RISK
open ↗Exploit-DB✓ VexDay Proof
MyHelpDesk 20020509 - SQL Injection
SQL injection vulnerability in index.php for MyHelpDesk 20020509, and possibly other versions, allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
W-Agora 4.1.x - Remote File Inclusion
PHP remote file inclusion vulnerability in w-Agora 4.1.3 allows remote attackers to execute arbitrary PHP code via the i
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 8 dtspcd - Remote Heap Overflow (Metasploit)
Buffer overflow in the client connection routine of libDtSvc.so.1 in CDE Subprocess Control Service (dtspcd) allows remo
60RISK
open ↗Exploit-DB✓ VexDay Proof
Seanox DevWex Windows Binary 1.2002.520 - File Disclosure
Directory traversal vulnerability in SeaNox Devwex before 1.2002.0601 allows remote attackers to read arbitrary files vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Splatt Forum 3.0 - Image Tag HTML Injection
Cross-site scripting vulnerability in Splatt Forum 3.0 allows remote attackers to execute arbitrary script as other user
23RISK
open ↗Exploit-DB✓ VexDay Proof
Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities
Vulnerabilities in Voxel Dot Net CBMS 0.7 and earlier allow remote attackers to conduct unauthorized operations as other
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebScripts WebBBS 4.x/5.0 - Remote Command Execution
webbbs_post.pl in WebBBS 4 and 5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5/6 - FTP Web View Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ftp.htt in Internet Explorer 5.5 and 6.0, when running on Windows 2000 with
28RISK
open ↗Exploit-DB✓ VexDay Proof
Telindus 1100 Series Router - Administration Password Leak
Telindus 1100 series ADSL router allows remote attackers to gain privileges to the device via a certain packet to UDP po
23RISK
open ↗Exploit-DB✓ VexDay Proof
Slurp 1.10 - SysLog Remote Format String
Format string vulnerability in log_doit function of Slurp NNTP client 1.1.0 allows a malicious news server to execute ar
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.