Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,230cataloged exploits
36,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,465Referência 23,022GitHub PoC 15,031VulnCheck XDB 8,860Nuclei 4,361Metasploit 3,491✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
SAP NetWeaver Dispatcher 7.0 ehp1/2 - Multiple Vulnerabilities
The DiagTraceAtoms function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player 11.3 - Font Parsing Code Execution (Metasploit)
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on L
100RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QuickTime plugin - Windows 4.1.2 (Japanese) Remote Overflow
Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
T-dah Webmail Client - Multiple Persistent Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - Time Element Memory Corruption (MS11-050)
The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 do
35RISK
open ↗Exploit-DB✓ VexDay Proof
Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Novell ZENworks Asset Management - Remote Execution (Metasploit)
Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote at
60RISK
open ↗Exploit-DB✓ VexDay Proof
Total Shop UK eCommerce CodeIgniter - Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in the refresh_page function in application/modules/_main/views/_top.php in Tot
23RISK
open ↗Exploit-DB✓ VexDay Proof
GNU glibc - Multiple Local Stack Buffer Overflow Vulnerabilities
Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related func
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Websphere MQ File Transfer Edition Web Gateway - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tunnelblick - Local Privilege Escalation (2)
Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname o
38RISK
open ↗Exploit-DB✓ VexDay Proof
Tunnelblick - Local Privilege Escalation (2)
Race condition in the runScript function in Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by r
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tunnelblick - Local Privilege Escalation (1)
Race condition in the runScript function in Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by r
23RISK
open ↗Exploit-DB✓ VexDay Proof
NetDecision 4.2 - TFTP Writable Directory Traversal Execution (Metasploit)
Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read
50RISK
open ↗Exploit-DB✓ VexDay Proof
Alt-N MDaemon free 12.5.4 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ubisoft uplay 2.0.3 - ActiveX Control Arbitrary Code Execution (Metasploit)
The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -
50RISK
open ↗Exploit-DB✓ VexDay Proof
T-dah Webmail Client 3.2.0-2.3 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
phpList 2.10.18 - 'unconfirmed' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Axigen Mail Server 8.0.1 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Axigen Mail Server 8.0.1 allows remote attackers to inject arbitrary web scr
23RISK
open ↗Exploit-DB✓ VexDay Proof
emailarchitect enterprise email server 10.0 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in EmailArchitect Email Server 10.0 and 10.0.0.3 allow remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
escon supportportal pro 3.0 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
afterlogic mailsuite pro (VMware Appliance) 6.3 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
mailtraq 2.17.3.3150 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin mini mail Dashboard widget 1.42 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
OTRS Open Technology Real Services 3.1.4 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13,
23RISK
open ↗Exploit-DB✓ VexDay Proof
smartermail free 9.2 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin postie 1.4.3 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Postie plugin 1.4.3, and possibly before 1.5.15, for WordPress allows re
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin simplemail 1.0.6 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the WP SimpleMail plugin 1.0.6 for WordPress allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin ThreeWP Email Reflector 1.13 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the ThreeWP Email Reflector plugin before 1.16 for WordPress allows remote a
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.