Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary co
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Git 1.6.3 - Parameter Processing Remote Denial of Service
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU cons
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
VerliAdmin 0.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and Web
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 Groupware Component - Multiple SQL Injections
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eM
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
EW-MusicPlayer 0.8 - '.m3u' Local Buffer Overflow (PoC)
Stack-based buffer overflow in BrotherSoft EW-MusicPlayer 0.8 allows remote attackers to cause a denial of service (appl
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Acrobat Reader 8.1.2 < 9.0 - 'getIcon()' Memory Corruption
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows r
100RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 10 / OpenSolaris - 'dtrace' Local Kernel Denial of Service (PoC)
Multiple unspecified vulnerabilities in the DTrace ioctl handlers in Sun Solaris 10, and OpenSolaris before snv_114, all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Openfire 3.x - jabber:iq:auth 'passwd_change' Remote Password Change
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authentic
23RISK
open ↗Exploit-DB✓ VexDay Proof
Winn ASP Guestbook 1.01b - Remote Database Disclosure
Winn ASP Guestbook 1.01 Beta stores sensitive information under the web root with insufficient access control, which all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Bmxplay 0.4.4b - '.bmx' Local Buffer Overflow (PoC)
Buffer overflow in BrotherSoft BMXPlay 0.4.4b allows remote attackers to cause a denial of service (application crash) o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.x (Sparc64) - '/proc/iomem' Local Denial of Service
The pci_register_iommu_region function in arch/sparc/kernel/pci_common.c in the Linux kernel before 2.6.29 on the sparc6
23RISK
open ↗Exploit-DB✓ VexDay Proof
GUPnP 0.12.7 - Message Handling Denial of Service
GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control m
23RISK
open ↗Exploit-DB✓ VexDay Proof
Beatport Player 1.0.0.283 - '.m3u' Local Buffer Overflow (PoC)
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
MiniTwitter 0.2b - Multiple SQL Injections
Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magic_quotes_gpc is disabled, allow remote authenti
23RISK
open ↗Exploit-DB✓ VexDay Proof
Beatport Player 1.0.0.283 - '.m3u' Local Stack Overflow (3)
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Beatport Player 1.0.0.283 - '.m3u' Local Stack Overflow (2)
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
RM Downloader - '.smi' Universal Local Buffer Overflow
Stack-based buffer overflow in Mini-stream RM Downloader allows remote attackers to execute arbitrary code via a long st
23RISK
open ↗Exploit-DB✓ VexDay Proof
MiniTwitter 0.2b - Remote User Options Changer
index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury Audio Player 1.21 - '.m3u' Local Stack Overflow
Stack-based buffer overflow in Mercury Audio Player 1.21 allows remote attackers to execute arbitrary code via a long st
23RISK
open ↗Exploit-DB✓ VexDay Proof
Addonics NAS Adapter FTP - Remote Denial of Service
Multiple buffer overflows in the FTP server on the Addonics NAS Adapter NASU2FW41 with loader 1.17 allow remote attacker
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.