Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Asx to Mp3 2.7.5 - Local Stack Overflow
Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary cod
28RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
20RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
20RISK
open ↗Exploit-DB✓ VexDay Proof
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
20RISK
open ↗Exploit-DB✓ VexDay Proof
Apache mod_cgi - 'Shellshock' Remote Command Injection
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
20RISK
open ↗Exploit-DB✓ VexDay Proof
Apache mod_cgi - 'Shellshock' Remote Command Injection
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
100RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB✓ VexDay Proof
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB✓ VexDay Proof
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
20RISK
open ↗Exploit-DB✓ VexDay Proof
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RISK
open ↗Exploit-DB
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB
Moab < 7.2.9 - Authentication Bypass
Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 allows remote attackers to bypass the signature check, impersona
23RISK
open ↗Exploit-DB
Epicor Enterprise 7.4 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Epicor Enterprise 7.4 before FS74SP6_HotfixTL054181 allow remote
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.