Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,095cataloged exploits
36,945CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,442GitHub PoC 15,312VulnCheck XDB 8,970Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (1)
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-
60RISK
open ↗Exploit-DB✓ VexDay Proof
Webmedia Explorer 5.0.9/5.10 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Webmedia Explorer (webmex) 5.09 and 5.10 allow remot
23RISK
open ↗Exploit-DB✓ VexDay Proof
Lussumo Vanilla 1.1.5/1.1.7 - 'updatecheck.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5 and 1.1.7 allows remote attack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Irssi 0.8.13 - 'WALLOPS' Message Off-by-One Heap Memory Corruption
Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ascad Networks 5 - Products Insecure Cookie Handling
Ascad Networks Password Protector SD 1.3.1 allows remote attackers to bypass authentication and gain administrative acce
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x (Gentoo 2.6.29rc1) - 'ptrace_attach' Local Privilege Escalation
Race condition in the ptrace_attach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users
23RISK
open ↗Exploit-DB✓ VexDay Proof
IPsec-Tools < 0.7.2 (racoon frag-isakmp) - Multiple Remote Denial of Service Vulnerabilities (PoC)
racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafte
28RISK
open ↗Exploit-DB✓ VexDay Proof
CastRipper 2.50.70 - '.m3u' Universal Stack Overflow
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
28RISK
open ↗Exploit-DB✓ VexDay Proof
CastRipper 2.50.70 - '.m3u' Local Buffer Overflow
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
28RISK
open ↗Exploit-DB✓ VexDay Proof
CastRipper 2.50.70 - '.m3u' Universal Stack Overflow
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
28RISK
open ↗Exploit-DB✓ VexDay Proof
CastRipper 2.50.70 - '.pls' Universal Stack Overflow
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari 3.2.2 - 'feed:' URI Multiple Input Validation Vulnerabilities
Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7
23RISK
open ↗Exploit-DB✓ VexDay Proof
Compress::Raw::Zlib Perl Module - Remote Code Execution
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey befor
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.3.2 - 'xml_utf8_decode()' UTF-8 Input Validation
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed su
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.10 - 'nsViewManager.cpp' Denial of Service
nsViewManager.cpp in Mozilla Firefox 3.0.2 through 3.0.10 allows remote attackers to cause a denial of service (NULL poi
23RISK
open ↗Exploit-DB✓ VexDay Proof
MPLAB IDE 8.30 - '.mcp' Universal Overwrite (SEH)
Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.x - Large '.GIF' File Background Denial of Service
Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - XML External Entity Information Disclosure
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for i
28RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - JavaScript 'onload()' Event Cross Domain Scripting
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone O
23RISK
open ↗Exploit-DB✓ VexDay Proof
Claroline 1.8.11 - '/claroline/linker/notfound.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
GrabIt 1.7.2x - NZB DTD Reference Buffer Overflow
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Verlihub Control Panel 1.7 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
Woodstock 4.2 404 - Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Almond Classifieds 5.6.2 - Blind SQL Injection
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eM
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.