Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,107cataloged exploits
36,322CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,464Referência 22,936GitHub PoC 15,010VulnCheck XDB 8,846Nuclei 4,361Metasploit 3,490✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
MayGion IP Cameras Firmware 09.27 - Multiple Vulnerabilities
Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Zavio IP Cameras Firmware 1.6.03 - Multiple Vulnerabilities
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless
35RISK
open ↗Exploit-DB✓ VexDay Proof
Nginx 1.3.9 < 1.4.0 - Chuncked Encoding Stack Buffer Overflow (Metasploit)
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
60RISK
open ↗Exploit-DB✓ VexDay Proof
AdobeCollabSync - Local Buffer Overflow / Adobe Reader X Sandbox Bypass (Metasploit)
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attacke
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase
The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vist
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase
20RISK
open ↗Exploit-DB✓ VexDay Proof
Python RRDtool Module - Function Format String
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attacker
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mutiny 5 - Arbitrary File Upload (Metasploit)
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow
50RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Mail On Update - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Cleanfix - Cross-Site Request Forgery
WordPress WP Cleanfix Plugin 2.4.4 has CSRF
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jojo CMS - 'search' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jojo CMS - 'x-forwarded-for' HTTP header SQL Injection
SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2
23RISK
open ↗Exploit-DB✓ VexDay Proof
Serva 32 TFTP 2.1.0 - Buffer Overflow (Denial of Service) (PoC)
Buffer overflow in the TFTPD service in Serva32 2.1.0 allows remote attackers to cause a denial of service (daemon crash
23RISK
open ↗Exploit-DB✓ VexDay Proof
ERS Viewer 2011 - '.ERS' File Handling Buffer Overflow (Metasploit)
Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 1
43RISK
open ↗Exploit-DB✓ VexDay Proof
MoinMoin - Arbitrary Command Execution
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anyw
28RISK
open ↗Exploit-DB✓ VexDay Proof
MoinMoin - Arbitrary Command Execution
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action
50RISK
open ↗Exploit-DB✓ VexDay Proof
NetApp OnCommand System Manager - '/zapiServlet' User Management Interface Multiple Cross-Site Scripting Vulnerabilities
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - CGenericElement Object Use-After-Free (Metasploit)
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbit
100RISK
open ↗Exploit-DB✓ VexDay Proof
NetApp OnCommand System Manager - '/zapiServlet' CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
b2evolution 4.1.6 - Multiple Vulnerabilities
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to
23RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link IP Cameras - Multiple Vulnerabilities
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP ses
28RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link IP Cameras - Multiple Vulnerabilities
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firm
35RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin W3 Total Cache - PHP Code Execution (Metasploit)
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability
60RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link IP Cameras - Multiple Vulnerabilities
An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.0
28RISK
open ↗Exploit-DB✓ VexDay Proof
sudo 1.8.0 < 1.8.3p1 - 'sudo_debug' glibc FORTIFY_SOURCE Bypass + Privilege Escalation
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Vivotek IP Cameras - Multiple Vulnerabilities
A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the
35RISK
open ↗Exploit-DB✓ VexDay Proof
WPS Office - 'Wpsio.dll' Stack Buffer Overflow
Stack-based buffer overflow in wpsio.dll in Kingsoft WPS Office 2012 possibly 8.1.0.3238 allows remote attackers to exec
28RISK
open ↗Exploit-DB✓ VexDay Proof
Vivotek IP Cameras - Multiple Vulnerabilities
An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP pac
28RISK
open ↗Exploit-DB✓ VexDay Proof
phpMyAdmin - 'preg_replace' (Authenticated) Remote Code Execution (Metasploit)
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.