Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Microsoft Remote Desktop Services - Web Proxy IE Sandbox Escape (MS15-004) (Metasploit)
Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7
100RISK
open ↗Exploit-DB
Sefrengo CMS 1.6.1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL comm
23RISK
open ↗Exploit-DB
Symantec Altiris Agent 6.9 (Build 648) - Local Privilege Escalation
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local us
23RISK
open ↗Exploit-DB
Trend Micro 8.0.1133 (Multiple Products) - Local Privilege Escalation
The tmeext.sys driver before 2.0.0.1015 in Trend Micro Antivirus Plus, Internet Security, and Maximum Security allows lo
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP Data Protector 8.x - Remote Command Execution
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
60RISK
open ↗Exploit-DB
McAfee Data Loss Prevention Endpoint - Arbitrary Write Privilege Escalation
McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, an
23RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec Encryption Management Server < 3.2.0 MP6 - Remote Command Injection
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrator
23RISK
open ↗Exploit-DB
ManageEngine Firewall Analyzer 8.0 - Directory Traversal / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Firewall Analyzer 7.2 allow remote attackers to inje
38RISK
open ↗Exploit-DB
Exim ESMTP 4.80 - glibc gethostbyname Denial of Service
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
60RISK
open ↗Exploit-DB✓ VexDay Proof
FreeBSD - Multiple Vulnerabilities
Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows
23RISK
open ↗Exploit-DB
Apple Mac OSX < 10.10.x - GateKeeper Bypass
LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypas
23RISK
open ↗Exploit-DB
Microsoft Windows Server 2003 SP2 - Local Privilege Escalation (MS14-070)
Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2)
43RISK
open ↗Exploit-DB
ManageEngine Firewall Analyzer 8.0 - Directory Traversal / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in fw/index2.do in ManageEngine Firewall Analyzer 7.2 allows remote attackers t
23RISK
open ↗Exploit-DB✓ VexDay Proof
FreeBSD - Multiple Vulnerabilities
Multiple array index errors in the Stream Control Transmission Protocol (SCTP) module in FreeBSD 10.1 before p5, 10.0 be
23RISK
open ↗Exploit-DB
Comodo Backup 4.4.0.0 - Null Pointer Dereference Privilege Escalation
The bdisk.sys driver in COMODO Backup before 4.4.1.23 allows remote attackers to gain privileges via a crafted device ha
23RISK
open ↗Exploit-DB✓ VexDay Proof
ferretCMS 1.0.4-alpha - Multiple Vulnerabilities
SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p
23RISK
open ↗Exploit-DB
Symantec Data Center Security - Multiple Vulnerabilities
The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symante
23RISK
open ↗Exploit-DB
jclassifiedsmanager - Multiple Vulnerabilities
SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execu
23RISK
open ↗Exploit-DB
Symantec Data Center Security - Multiple Vulnerabilities
SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and
23RISK
open ↗Exploit-DB
Symantec Data Center Security - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
ferretCMS 1.0.4-alpha - Multiple Vulnerabilities
Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code b
23RISK
open ↗Exploit-DB✓ VexDay Proof
Android WiFi-Direct - Denial of Service
WiFiMonitor in Android 4.4.4 as used in the Nexus 5 and 4, Android 4.2.2 as used in the LG D806, Android 4.2.2 as used i
23RISK
open ↗Exploit-DB
ManageEngine ServiceDesk Plus 9.0 < Build 9031 - User Privileges Management
ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive tic
23RISK
open ↗Exploit-DB
jclassifiedsmanager - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attac
23RISK
open ↗Exploit-DB
VideoLAN VLC Media Player 2.1.5 - DEP Access Violation
The picture_pool_Delete function in misc/picture_pool.c in VideoLAN VLC media player 2.1.5 allows remote attackers to ex
23RISK
open ↗Exploit-DB
VideoLAN VLC Media Player 2.1.5 - Write Access Violation
The picture_Release function in misc/picture.c in VideoLAN VLC media player 2.1.5 allows remote attackers to execute arb
23RISK
open ↗Exploit-DB
Symantec Data Center Security - Multiple Vulnerabilities
The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security:
23RISK
open ↗Exploit-DB✓ VexDay Proof
ferretCMS 1.0.4-alpha - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
ferretCMS 1.0.4-alpha - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
OP5 5.3.5/5.4.0/5.4.2/5.5.0/5.5.1 - 'license.php' Remote Command Execution (Metasploit)
license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execu
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.