Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,697cataloged exploits
36,715CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,264GitHub PoC 15,172VulnCheck XDB 8,920Nuclei 4,373Metasploit 3,493✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit)
Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause
50RISK
open ↗Exploit-DB✓ VexDay Proof
AppleFileServer (OSX) - LoginExt PathName Overflow (Metasploit)
Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitr
50RISK
open ↗Exploit-DB✓ VexDay Proof
TinyIdentD 2.2 - Remote Stack Buffer Overflow (Metasploit)
Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long s
50RISK
open ↗Exploit-DB✓ VexDay Proof
3Com 3CDaemon 2.0 FTP Server - 'Username' Remote Overflow (Metasploit)
Buffer overflow in the FTP service in 3Com 3CDaemon 2.0 revision 10 allows remote attackers to cause a denial of service
50RISK
open ↗Exploit-DB✓ VexDay Proof
TikiWiki tiki-graph_formula - PHP Remote Code Execution (Metasploit)
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f ar
60RISK
open ↗Exploit-DB✓ VexDay Proof
LightNEasy CMS 3.2.1 - Blind SQL Injection
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM TPM for OS Deployment 5.1.0.x - 'rembo.exe' Remote Buffer Overflow (Metasploit)
The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly hand
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook - 'ATTACH_BY_REF_ONLY' File Execution (MS10-045) (Metasploit)
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Help Center - Cross-Site Scripting / Command Execution (MS10-042) (Metasploit)
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server
60RISK
open ↗Exploit-DB✓ VexDay Proof
QBik WinGate WWW Proxy Server - URL Processing Overflow (Metasploit)
Stack-based buffer overflow in the WWW Proxy Server of Qbik WinGate 6.1.1.1077 allows remote attackers to cause a denial
60RISK
open ↗Exploit-DB✓ VexDay Proof
McAfee Visual Trace - ActiveX Control Buffer Overflow (Metasploit)
Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Ex
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP) (MS07-017) (Metasploit)
Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code
50RISK
open ↗Exploit-DB✓ VexDay Proof
MaxDB WebDBM - 'Database' Remote Overflow (Metasploit)
Buffer overflow in SAP DB and MaxDB before 7.6.00.30 allows remote attackers to execute arbitrary code via a long databa
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft WINS - Service Memory Overwrite (MS04-045) (Metasploit)
The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Server, and Windows Server 2003 allows remo
60RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java - Calendar Deserialization (Metasploit)
The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; a
60RISK
open ↗Exploit-DB✓ VexDay Proof
Sun Java JRE - getSoundbank 'file://' URI Buffer Overflow (Metasploit)
Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, J
60RISK
open ↗Exploit-DB✓ VexDay Proof
Apple iPhone MobileSafari LibTIFF - 'email' Remote Buffer Overflow (Metasploit) (2)
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and othe
50RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Suite/Firefox - Navigator Object Code Execution (Metasploit)
Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by chang
60RISK
open ↗Exploit-DB✓ VexDay Proof
Unreal Tournament 2004 (Windows) - 'secure' Remote Overflow (Metasploit)
The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier,
60RISK
open ↗Exploit-DB✓ VexDay Proof
PeaZIP 2.6.1 - Zip Processing Command Injection (Metasploit)
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .z
50RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.5 - 'escape()' Return Value Memory Corruption (Metasploit)
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1
50RISK
open ↗Exploit-DB✓ VexDay Proof
iPhone MobileMail - LibTIFF Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in the TIFF library (libtiff) before 3.8.2, as used in Adobe Reader 9.3.0 and othe
50RISK
open ↗Exploit-DB✓ VexDay Proof
Arugizer Trojan Horse (Energizer DUO) - Code Execution (Metasploit)
UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Aru
43RISK
open ↗Exploit-DB✓ VexDay Proof
Apple QTJava - 'toQTPointer()' Arbitrary Memory Access (Metasploit)
Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows rem
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Outlook - 'ATTACH_BY_REF_RESOLVE' File Execution (MS10-045) (Metasploit)
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_
50RISK
open ↗Exploit-DB✓ VexDay Proof
eIQNetworks ESA - License Manager LICMGR_ADDLICENSE Overflow (Metasploit)
Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in product
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - location.QueryInterface() Code Execution (Metasploit)
Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attac
60RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX NewObject Method Buffer Overflow (Metasploit)
Stack-based buffer overflow in the WebexUCFObject ActiveX control in atucfobj.dll in Cisco WebEx Meeting Manager before
50RISK
open ↗Exploit-DB✓ VexDay Proof
LightNEasy CMS 3.2.1 - Blind SQL Injection
SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
BakBone NetVault - Remote Heap Overflow (Metasploit)
Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow (1) remote attackers to execute arbitrary code via a mod
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.