Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,386cataloged exploits
36,533CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,104GitHub PoC 15,075VulnCheck XDB 8,883Nuclei 4,365Metasploit 3,493✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
Joomla! Component Newsfeeds - SQL Injection
SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before
100RISK
open ↗Exploit-DB✓ VexDay Proof
Scratcher - SQL Injection / Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web sc
23RISK
open ↗Exploit-DB✓ VexDay Proof
chCounter - indirect SQL Injection / Cross-Site Scripting
SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
chCounter - indirect SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
iScripts VisualCaster - SQL Injection
SQL injection vulnerability in flashPlayer/playVideo.php in iScripts VisualCaster allows remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
Scratcher - SQL Injection / Cross-Site Scripting
SQL injection vulnerability in projects.php in Scratcher allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
TaskFreak 0.6.2 - SQL Injection
SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn_mysql.php in Tirzen (aka TZN)
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft SharePoint Server 2007 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possi
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Services - ConnectFunnel Stack Buffer Overflow (MS10-025) (Metasploit)
Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 200
50RISK
open ↗Exploit-DB✓ VexDay Proof
Samba 2.2.2 < 2.2.6 - 'nttrans' Remote Buffer Overflow (Metasploit) (1)
Buffer overflow in the SMB/CIFS packet fragment re-assembly code for SMB daemon (smbd) in Samba before 2.2.8, and Samba-
45RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBizScripts Dating Script - SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the (1)
23RISK
open ↗Exploit-DB✓ VexDay Proof
gpEasy 1.6.1 - Cross-Site Request Forgery (Add Admin)
Cross-site request forgery (CSRF) vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijac
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP Video Battle - SQL Injection
SQL injection vulnerability in browse.html in PHP Video Battle Script allows remote attackers to execute arbitrary SQL c
23RISK
open ↗Exploit-DB✓ VexDay Proof
SoftBizScripts Hosting Script - SQL Injection
Multiple SQL injection vulnerabilities in Softbiz Web Host Directory Script 1.1 and earlier allow remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Modelbook - 'casting_view.php' SQL Injection
SQL injection vulnerability in casting_view.php in Modelbook allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component SmartSite 1.0.0 - Local File Inclusion
Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers t
43RISK
open ↗Exploit-DB✓ VexDay Proof
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1)
23RISK
open ↗Exploit-DB✓ VexDay Proof
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
aavmker4.sys in avast! Home and Professional 4.7 for Windows does not properly validate input to IOCTL 0xb2d60030, which
23RISK
open ↗Exploit-DB✓ VexDay Proof
CLScript.com Classifieds Software - SQL Injection
SQL injection vulnerability in help-details.php in CLScript Classifieds Script allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB✓ VexDay Proof
memcached 1.4.2 - Memory Consumption Remote Denial of Service
memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.34 - 'find_keyring_by_name()' Local Memory Corruption
Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlie
23RISK
open ↗Exploit-DB✓ VexDay Proof
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly
23RISK
open ↗Exploit-DB✓ VexDay Proof
Infocus Real Estate Enterprise Edition Script - Authentication Bypass
Multiple SQL injection vulnerabilities in system_member_login.php in Infocus Real Estate Enterprise Edition allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
FreeRealty(Free Real Estate Listing Software) - Authentication Bypass
Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component NoticeBoard 1.3 - Local File Inclusion
Directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows remo
43RISK
open ↗Exploit-DB✓ VexDay Proof
2DayBiz Auction Script - Authentication Bypass
Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component ABC 1.1.7 - SQL Injection
SQL injection vulnerability in the Airiny ABC (com_abc) component 1.1.7 for Joomla! allows remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion
Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows rem
43RISK
open ↗Exploit-DB✓ VexDay Proof
Webkit (Apple Safari 4.0.5) - Blink Tag Stack Exhaustion Denial of Service
Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.