Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,641cataloged exploits
37,379CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 23,825GitHub PoC 15,387VulnCheck XDB 9,029Nuclei 4,416Metasploit 3,502✓ verified onlyrecentpopularrisk
24,482 exploits
Exploit-DB✓ VexDay Proof
IBM Lotus QuickR qp2 - ActiveX Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-00
50RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus iNotes dwa85W - ActiveX Buffer Overflow (Metasploit)
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x befo
43RISK
open ↗Exploit-DB✓ VexDay Proof
RealPlayer - '.RealMedia' File Handling Buffer Overflow (Metasploit)
Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers
50RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Lotus Notes Client URL Handler - Command Injection (Metasploit)
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted
50RISK
open ↗Exploit-DB✓ VexDay Proof
Foswiki MAKETEXT - Remote Command Execution (Metasploit)
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
50RISK
open ↗Exploit-DB✓ VexDay Proof
Foswiki MAKETEXT - Remote Command Execution (Metasploit)
The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows r
35RISK
open ↗Exploit-DB✓ VexDay Proof
TWiki MAKETEXT - Remote Command Execution (Metasploit)
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
50RISK
open ↗Exploit-DB✓ VexDay Proof
Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
50RISK
open ↗Exploit-DB✓ VexDay Proof
banana dance b.2.6 - Multiple Vulnerabilities
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to
23RISK
open ↗Exploit-DB
FireFly Mediaserver 1.0.0.1359 - Null Pointer Dereference
Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1
28RISK
open ↗Exploit-DB✓ VexDay Proof
banana dance b.2.6 - Multiple Vulnerabilities
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Elite Bulletin Board 2.1.21 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Eli
23RISK
open ↗Exploit-DB✓ VexDay Proof
Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote atta
50RISK
open ↗Exploit-DB✓ VexDay Proof
banana dance b.2.6 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
InduSoft Web Studio - 'ISSymbol.ocx InternationalSeparator()' Heap Overflow (Metasploit)
Multiple buffer overflows in the ISSymbol ActiveX control in ISSymbol.ocx 61.6.0.0 and 301.1009.2904.0 in the ISSymbol v
50RISK
open ↗Exploit-DB✓ VexDay Proof
Crystal Reports CrystalPrintControl - ActiveX ServerResourceVersion Property Overflow (Metasploit)
Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753
50RISK
open ↗Exploit-DB✓ VexDay Proof
PHPWCMS 1.5.4.6 - 'preg_replace' Multiple Vulnerabilities
IRIS citations management tool through 1.3 allows remote attackers to execute arbitrary commands.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 3.3.5 - Btrfs CRC32C feature Infinite Loop Local Denial of Service
The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial o
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Portable phpMyAdmin - Authentication Bypass
The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain ph
28RISK
open ↗Exploit-DB
Cisco Wireless Lan Controller 7.2.110.0 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) dev
23RISK
open ↗Exploit-DB
Cisco Wireless Lan Controller 7.2.110.0 - Multiple Vulnerabilities
screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote a
23RISK
open ↗Exploit-DB
Cisco Wireless Lan Controller 7.2.110.0 - Multiple Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software
23RISK
open ↗Exploit-DB
Centreon Enterprise Server 2.3.3 < 2.3.9-4 - Blind SQL Injection
SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote
23RISK
open ↗Exploit-DB
Axway Secure Transport 5.1 SP2 - Directory Traversal
Multiple directory traversal vulnerabilities in Axway SecureTransport 5.1 SP2 and earlier allow remote authenticated use
23RISK
open ↗Exploit-DB✓ VexDay Proof
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbi
50RISK
open ↗Exploit-DB✓ VexDay Proof
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrar
60RISK
open ↗Exploit-DB✓ VexDay Proof
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and ex
60RISK
open ↗Exploit-DB✓ VexDay Proof
HP Data Protector - DtbClsLogin Buffer Overflow (Metasploit)
Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x befo
38RISK
open ↗Exploit-DB✓ VexDay Proof
SimpleInvoices invoices Module - Customer Field Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attacker
23RISK
open ↗Exploit-DB✓ VexDay Proof
Smartphone Pentest Framework - Multiple Remote Command Execution Vulnerabilities
Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary comman
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.