Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,409cataloged exploits
37,196CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,478Referência 23,664GitHub PoC 15,347VulnCheck XDB 9,003Nuclei 4,415Metasploit 3,502✓ verified onlyrecentpopularrisk
24,478 exploits
Exploit-DB✓ VexDay Proof
Ilya Birman E2 - '/@actions/comment-process' SQL Injection
SQL injection vulnerability in E2 before 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the no
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVisi
23RISK
open ↗Exploit-DB
Microsoft Windows XP SP3 - 'BthPan.sys' Arbitrary Write Privilege Escalation
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISK
open ↗Exploit-DB
Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - 'ptrace/sysret' Local Privilege Escalation
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved
23RISK
open ↗Exploit-DB
Apache 2.4.7 mod_status - Scoreboard Handling Race Condition
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
45RISK
open ↗Exploit-DB
Raritan PowerIQ 4.1.0 - SQL Injection (Metasploit)
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote aut
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote auth
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities on IBM GCM16 and GCM32 Global Console Manager switches with firmware
23RISK
open ↗Exploit-DB
Microsoft Windows XP SP3 - 'MQAC.sys' Arbitrary Write Privilege Escalation
Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write
43RISK
open ↗Exploit-DB
WordPress Plugin Gallery Objects 0.4 - SQL Injection
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB
ACME micro_httpd - Denial of Service
Buffer overflow in ACME micro_httpd, as used in D-Link DSL2750U and DSL2740U and NetGear WGR614 and MR-ADSL-DG834 router
28RISK
open ↗Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/affiliate_signup.php?a_country' SQL Injection
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'endpoint_generic.php' SQL Injection
SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/affiliate_show_banner.php?affiliate_banner_id' SQL Injection
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/admin/create_account.php?entry_country_id' SQL Injection
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'repo.php' Directory Traversal
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISK
open ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'index.php' Directory Traversal
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISK
open ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'index.php' Remote Code Execution
maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacha
23RISK
open ↗Exploit-DB✓ VexDay Proof
Omeka 2.2 - Cross-Site Request Forgery / Persistent Cross-Site Scripting
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the au
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'asterisk_info.php' Directory Traversal
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISK
open ↗Exploit-DB✓ VexDay Proof
OL-Commerce - '/OL-Commerce/create_account.php?country' SQL Injection
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Fonality trixbox - 'endpointcfg.php' Directory Traversal
Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a ..
43RISK
open ↗Exploit-DB
BitDefender GravityZone 5.1.5.386 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read
35RISK
open ↗Exploit-DB
Node Browserify 4.2.0 - Remote Code Execution
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
28RISK
open ↗Exploit-DB✓ VexDay Proof
Alfresco - '/cmisbrowser?url' Server-Side Request Forgery
Server-side request forgery (SSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Servi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alfresco - '/proxy?endpoint' Server-Side Request Forgery
Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows
23RISK
open ↗Exploit-DB
Boat Browser 8.0/8.0.1 - Remote Code Execution
The WebView class and use of the WebView.addJavascriptInterface method in the Boat Browser application 8.0 and 8.0.1 for
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Youtube Gallery 4.1.7 - SQL Injection
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x throu
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.