Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities
SQL injection vulnerability in Invision Power Board (IPB) 2.0.3 and earlier allows remote attackers to execute arbitrary
28RISK
open ↗Exploit-DB
Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in (1) search.php and (2) topics.php for Invision Power Board (IPB) 2.0.3 and e
23RISK
open ↗Exploit-DB
Apache Xerces-C XML Parser < 3.1.2 - Denial of Service (PoC)
internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentatio
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - UncompressViaZlibVariant Uninitialized Memory (Metasploit)
Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on
60RISK
open ↗Exploit-DB
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce
23RISK
open ↗Exploit-DB
Foxit Reader PDF 7.1.3.320 - Parsing Memory Corruption
Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1.5 allow remote attackers to cause a denial of service (memory
23RISK
open ↗Exploit-DB
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPr
23RISK
open ↗Exploit-DB
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1
28RISK
open ↗Exploit-DB
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional Wo
23RISK
open ↗Exploit-DB
MiniUPnPd 1.0 (MIPS) - Remote Stack Overflow Remote Code Execution for AirTies RT Series
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP
50RISK
open ↗Exploit-DB
OTRS < 3.1.x / < 3.2.x / < 3.3.x - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15,
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Core 4.2 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to i
28RISK
open ↗Exploit-DB✓ VexDay Proof
Free MP3 CD Ripper 2.6 2.8 (Windows 7) - '.wav' File Buffer Overflow (SEH) (DEP Bypass)
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗Exploit-DB✓ VexDay Proof
Free MP3 CD Ripper 2.6 2.8 - '.wav' File Buffer Overflow (SEH)
Stack-based buffer overflow in Free MP3 CD Ripper 1.1, 2.6 and earlier, when converting a file, allows user-assisted rem
50RISK
open ↗Exploit-DB
usb-creator 0.2.x (Ubuntu 12.04/14.04/14.10) - Local Privilege Escalation
usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubu
23RISK
open ↗Exploit-DB✓ VexDay Proof
GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arb
28RISK
open ↗Exploit-DB✓ VexDay Proof
GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute
50RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - copyPixelsToByteArray Integer Overflow (Metasploit)
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS
60RISK
open ↗Exploit-DB✓ VexDay Proof
GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arb
60RISK
open ↗Exploit-DB
ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
60RISK
open ↗Exploit-DB
WordPress Plugin Community Events 1.3.5 - SQL Injection
SQL injection vulnerability in WordPress Community Events plugin before 1.4.
23RISK
open ↗Exploit-DB✓ VexDay Proof
GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection
Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAu
28RISK
open ↗Exploit-DB
ADB - Backup Archive File Overwrite Directory Traversal
Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate att
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Reflex Gallery - Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 f
50RISK
open ↗Exploit-DB
WordPress Plugin Tune Library 1.5.4 - SQL Injection
SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5.
23RISK
open ↗Exploit-DB
Apple Mac OSX - Local Denial of Service
The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denia
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Creative Contact Form - Arbitrary File Upload (Metasploit)
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery
60RISK
open ↗Exploit-DB✓ VexDay Proof
BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion
Directory traversal vulnerability in the CFChart servlet (com.naryx.tagfusion.cfm.cfchartServlet) in New Atlanta BlueDra
23RISK
open ↗Exploit-DB
AZBB < 1.0.07d - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in AZ Bulletin board (AZbb) before 1.0.08 allow (1) remote authenticated us
23RISK
open ↗Exploit-DB
AZBB < 1.0.07d - Multiple Vulnerabilities
PHP remote file inclusion vulnerability in main_index.php in AZ Bulletin Board (AZbb) 1.0.07a through 1.0.07c allows rem
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.