Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,324cataloged exploits
36,054CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,721GitHub PoC 14,477VulnCheck XDB 8,829Nuclei 4,350Metasploit 3,489✓ verified onlyrecentpopularrisk
24,458 exploits
Exploit-DB✓ VexDay Proof
dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation
dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to o
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Net.Data 7.0 - Full Path Disclosure
document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Caucho Technology Resin 1.2 - JSP Source Disclosure
Caucho Technology Resin 1.2 and possibly earlier allows remote attackers to view JSP source via an HTTP request to a .js
23RISK
open ↗Exploit-DB✓ VexDay Proof
Network Associates Webshield SMTP 4.5 - Invalid Outgoing Recipient Field Denial of Service
McAfee WebShield SMTP 4.5 allows remote attackers to cause a denial of service via a malformed recipient field.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 7.0 - '.asx' Remote Buffer Overflow
Buffer overflow in Microsoft Windows Media Player allows remote attackers to execute arbitrary commands via a malformed
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 7.0 - '.wms' Arbitrary Script (MS00-090)
Microsoft Windows Media Player 7 executes scripts in custom skin (.WMS) files, which could allow remote attackers to gai
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsys CyberPatrol 4.0 4.003/4.0 4.005 - Insecure Registration
Microsys CyberPatrol uses weak encryption (trivial encoding) for credit card numbers and uses no encryption for the rema
23RISK
open ↗Exploit-DB✓ VexDay Proof
Unify eWave ServletExec 3 - .JSP Source Disclosure
Unify ServletExec AS v3.0C allows remote attackers to read source code for JSP pages via an HTTP request that ends with
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 2.x/7.0/8 - 'Catman' Race Condition (1)
catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID tempo
23RISK
open ↗Exploit-DB✓ VexDay Proof
WU-FTPD 2.6.0 - Remote Command Execution
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remo
60RISK
open ↗Exploit-DB✓ VexDay Proof
BSDi SUIDPerl - Local Stack Buffer Overflow
Buffer overflow in suidperl (sperl), Perl 4.x and 5.x.
23RISK
open ↗Exploit-DB✓ VexDay Proof
BSDi 3.0/4.0 - 'rcvtty[mh]' Local Privilege Escalation
rcvtty in BSD 3.0 and 4.0 does not properly drop privileges before executing a script, which allows local attackers to g
23RISK
open ↗Exploit-DB✓ VexDay Proof
vixie-cron - Local Privilege Escalation
crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is own
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 2.x/7.0/8 - 'Catman' Race Condition (2)
catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID tempo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris/SPARC 2.7 / 7 locale - Format String
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which
28RISK
open ↗Exploit-DB✓ VexDay Proof
Jan Hubicka Koules 1.4 - 'Svgalib' Local Buffer Overflow
Buffer overflow in Koules 1.4 allows local users to execute arbitrary commands via a long command line argument.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 8.x - cmctl Buffer Overflow
Buffer overflow in cmctl program in Oracle 8.1.5 Connection Manager Control allows local users to gain privileges via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Markus Triska CGIForum 1.0 - 'thesection' Directory Traversal
Directory traversal vulnerability in cgiforum.pl script in CGIForum 1.0 allows remote attackers to ready arbitrary files
23RISK
open ↗Exploit-DB✓ VexDay Proof
BB4 Big Brother Network Monitor 1.5 d2 - 'bb-hist.sh?HISTFILE' File Existence Disclosure
bb-hist.sh, bb-histlog.sh, bb-hostsvc.sh, bb-rep.sh, bb-replog.sh, and bb-ack.sh in Big Brother (BB) before 1.5d3 allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP-UX 11.00/10.20 crontab - Overwrite Files
HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
dump 0.4b15 - Local Privilege Escalation
dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ethereal - AFS Buffer Overflow
Multiple buffer overflows in AFS ACL parser for Ethereal 0.8.13 and earlier allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary comman
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary comman
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary comman
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary comman
45RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle (oidldapd connect) - Local Command Line Overflow
Buffer overflow in oidldapd in Oracle 8.1.6 allow local users to gain privileges via a long "connect" command line param
23RISK
open ↗Exploit-DB✓ VexDay Proof
RedHat 6.2 Restore and Dump - Local Privilege Escalation
restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which a
23RISK
open ↗Exploit-DB✓ VexDay Proof
RedHat 6.2 - '/sbin/restore' Local Privilege Escalation
restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which a
23RISK
open ↗Exploit-DB✓ VexDay Proof
RealServer 5.0/6.0/7.0 - Memory Contents Disclosure
Real Networks RealServer 7 and earlier allows remote attackers to obtain portions of RealServer's memory contents, possi
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.