Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase
20RISK
open ↗Exploit-DB✓ VexDay Proof
Python RRDtool Module - Function Format String
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attacker
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mutiny 5 - Arbitrary File Upload (Metasploit)
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow
50RISK
open ↗Exploit-DB
Exponent CMS 2.2.0 Beta 3 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execut
23RISK
open ↗Exploit-DB
Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC)
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
60RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Cleanfix - Cross-Site Request Forgery
WordPress WP Cleanfix Plugin 2.4.4 has CSRF
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Mail On Update - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote at
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jojo CMS - 'x-forwarded-for' HTTP header SQL Injection
SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jojo CMS - 'search' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in plugins/jojo_core/forgot_password.php in Jojo before 1.2.2 allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Serva 32 TFTP 2.1.0 - Buffer Overflow (Denial of Service) (PoC)
Buffer overflow in the TFTPD service in Serva32 2.1.0 allows remote attackers to cause a denial of service (daemon crash
23RISK
open ↗Exploit-DB
UMI CMS 2.9 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hij
23RISK
open ↗Exploit-DB
Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1)
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t
83RISK
open ↗Exploit-DB
Linux Kernel < 3.8.x - open-time Capability 'file_ns_capable()' Local Privilege Escalation
kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_m
23RISK
open ↗Exploit-DB✓ VexDay Proof
ERS Viewer 2011 - '.ERS' File Handling Buffer Overflow (Metasploit)
Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 1
43RISK
open ↗Exploit-DB✓ VexDay Proof
MoinMoin - Arbitrary Command Execution
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action
50RISK
open ↗Exploit-DB
ColdFusion 9-10 - Credential Disclosure
Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files
60RISK
open ↗Exploit-DB✓ VexDay Proof
MoinMoin - Arbitrary Command Execution
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anyw
28RISK
open ↗Exploit-DB✓ VexDay Proof
NetApp OnCommand System Manager - '/zapiServlet' CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject
23RISK
open ↗Exploit-DB
Cisco Linksys E4200 - Multiple Vulnerabilities
Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers
28RISK
open ↗Exploit-DB
Cisco Linksys E4200 - Multiple Vulnerabilities
Cisco Linksys E4200 1.0.05 Build 7 devices contain an Information Disclosure Vulnerability which allows remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
b2evolution 4.1.6 - Multiple Vulnerabilities
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to
23RISK
open ↗Exploit-DB
Huawei SNMPv3 Service - Multiple Buffer Overflow Vulnerabilities (PoC)
Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 is enabled, allow remote attackers to cause a denial of se
23RISK
open ↗Exploit-DB
Cisco Linksys E4200 - Multiple Vulnerabilities
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Clickjacking Vulnerability which allows remote attackers to obtain
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - CGenericElement Object Use-After-Free (Metasploit)
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbit
100RISK
open ↗Exploit-DB
Cisco Linksys E4200 - Multiple Vulnerabilities
Cisco Linksys E4200 1.0.05 Build 7 devices contain a Security Bypass Vulnerability which could allow remote attackers to
28RISK
open ↗Exploit-DB✓ VexDay Proof
NetApp OnCommand System Manager - '/zapiServlet' User Management Interface Multiple Cross-Site Scripting Vulnerabilities
Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject
23RISK
open ↗Exploit-DB
Cisco Linksys E4200 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow rem
28RISK
open ↗Exploit-DB
Huawei SNMPv3 Service - Multiple Buffer Overflow Vulnerabilities (PoC)
Stack-based buffer overflow on Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 debugging is enabled, allow
23RISK
open ↗Exploit-DB
Cisco Linksys E4200 - Multiple Vulnerabilities
Cisco Linksys E4200 1.0.05 Build 7 devices store passwords in cleartext allowing remote attackers to obtain sensitive in
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.