Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,697cataloged exploits
36,715CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,264GitHub PoC 15,172VulnCheck XDB 8,920Nuclei 4,373Metasploit 3,493✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
DeDeCMS 5.1 - SQL Injection
SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Achievo 1.3.4 - Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
Achievo 1.3.4 - SQL Injection
SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Palm Pre WebOS 1.1 - Denial of Service
The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Reader 9.1.3 / Acrobat - COM Objects Memory Corruption Remote Code Execution
Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 allow attackers to cause a den
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5.0.1 - 'deflate' HTTP Content Encoding Remote Code Execution
Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute ar
53RISK
open ↗Exploit-DB✓ VexDay Proof
Dream Poll 3.1 - '/index.php' Cross-Site Scripting / SQL Injection
Multiple SQL injection vulnerabilities in index.php in Dreamlevels DreamPoll 3.1 allow remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
Quick Heal 10.00 SP1 - Local Privilege Escalation
Quick Heal AntiVirus Plus 2009 10.00 SP1 and Quick Heal Total Security 2009 10.00 SP1 use weak permissions (Everyone: Fu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Achievo 1.x - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary w
23RISK
open ↗Exploit-DB✓ VexDay Proof
EZRecipeZee CMS 91 - Remote File Inclusion
Directory traversal vulnerability in config/config.php in ezRecipe-Zee 91, when register_globals is enabled, allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
httpdx 1.4.5 - dot Character Remote File Disclosure
httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) charact
23RISK
open ↗Exploit-DB✓ VexDay Proof
Docebo 3.6.0.3 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Docebo 3.6.0.3 allow remote attackers to execute arbitrary SQL commands via (1
23RISK
open ↗Exploit-DB✓ VexDay Proof
DreamPoll 3.1 - SQL Injection
Cross-site scripting (XSS) vulnerability in index.php in Dreamlevels DreamPoll 3.1 allows remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
DreamPoll 3.1 - SQL Injection
Multiple SQL injection vulnerabilities in index.php in Dreamlevels DreamPoll 3.1 allow remote attackers to execute arbit
23RISK
open ↗Exploit-DB✓ VexDay Proof
FreeBSD 6.4 - 'pipeclose()'/'knlist_cleardel()' Race Condition
Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Riorey RIOS 4.7.0 - Hard-Coded Password
RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel
23RISK
open ↗Exploit-DB✓ VexDay Proof
httpdx 1.4 - GET Buffer Overflow
Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote at
50RISK
open ↗Exploit-DB✓ VexDay Proof
HP LaserJet Printers - Multiple Persistent Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJe
23RISK
open ↗Exploit-DB✓ VexDay Proof
AIOCP 1.4.001 - Remote File Inclusion
PHP remote file inclusion vulnerability in public/code/cp_html2xhtmlbasic.php in All In One Control Panel (AIOCP) 1.4.00
23RISK
open ↗Exploit-DB✓ VexDay Proof
VMware Player / VMware Workstation 6.5.3 - 'VMware-authd' Remote Denial of Service
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 befor
28RISK
open ↗Exploit-DB✓ VexDay Proof
BulletProof FTP Client 2.63 b56 - '.bps' File Stack Buffer Overflow
Stack-based buffer overflow in BulletProof FTP Client allows user-assisted attackers to execute arbitrary code via a .bp
23RISK
open ↗Exploit-DB✓ VexDay Proof
X-Cart Email Subscription - 'email' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dopewars Server 1.5.12 - Denial of Service
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with
50RISK
open ↗Exploit-DB✓ VexDay Proof
AfterLogic WebMail Pro 4.7.10 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
e-Courier CMS - 'UserGUID' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web scri
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Informix Client SDK 3.0 - '.nfx' File Integer Overflow
Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Run
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alleycode 2.21 - Local Overflow (SEH)
Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alleycode 2.21 - Local Overflow (SEH)
Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Empire CMS 47 - SQL Injection
SQL injection vulnerability in Empire CMS 5.1 allows remote attackers to execute arbitrary SQL commands via the bid para
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Soundset 1.0 - SQL Injection
SQL injection vulnerability in the Soundset (com_soundset) component 1.0 for Joomla! allows remote attackers to execute
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.