Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Beatport Player 1.0.0.283 - '.m3u' Local Buffer Overflow (PoC)
CVE-2009-4756—doswindows01 May 2009
Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execu
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mercury Audio Player 1.21 - '.b4s' Local Stack Overflow
CVE-2009-4755—localwindows30 Apr 2009
Multiple stack-based buffer overflows in Mercury Audio Player 1.21 allow remote attackers to execute arbitrary code via
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GnuTLS 2.6.x - libgnutls lib/pk-libgcrypt.c Malformed DSA Key Handling Remote Denial of Service
CVE-2009-1415—doslinux30 Apr 2009
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows rem
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mercury Audio Player 1.21 - '.m3u' Local Stack Overflow (PoC)
CVE-2009-4754—doswindows30 Apr 2009
Stack-based buffer overflow in Mercury Audio Player 1.21 allows remote attackers to execute arbitrary code via a long st
23RISK
open ↗
Exploit-DB✓ VexDay Proof
GnuTLS 2.6.x - libgnutls lib/gnutls_pk.c DSA Key Storage Remote Spoofing
CVE-2009-1416—remotelinux30 Apr 2009
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the i
23RISK
open ↗
Exploit-DB✓ VexDay Proof
mpegable Player 2.12 - '.yuv' Local Stack Overflow (PoC)
CVE-2009-4758—doswindows29 Apr 2009
Stack-based buffer overflow in dicas Mpegable Player 2.12 allows remote attackers to cause a denial of service (applicat
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Coppermine Photo Gallery 1.4.21 - 'css' Cross-Site Scripting
CVE-2009-1616—webappsphp29 Apr 2009
Cross-site scripting (XSS) vulnerability in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.22 allows remo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Symantec Fax Viewer Control 10 - 'DCCFAXVW.dll' Remote Buffer Overflow
CVE-2009-2570—remotewindows29 Apr 2009
Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.20/2.6.24/2.6.27_7-10 (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Overflow
CVE-2009-0065—remotelinux28 Apr 2009
Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linu
28RISK
open ↗
Exploit-DB✓ VexDay Proof
MIM: InfiniX 1.2.003 - Multiple SQL Injections
CVE-2009-2451—webappsphp28 Apr 2009
Multiple SQL injection vulnerabilities in index.php in MIM:InfiniX 1.2.003 and possibly earlier versions allow remote at
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Symantec (Multiple Products) - Intel Common Base Agent Remote Command Execution
CVE-2009-1429—remotewindows28 Apr 2009
The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Cente
60RISK
open ↗
Exploit-DB✓ VexDay Proof
libvirt_proxy 0.5.1 - Local Privilege Escalation
CVE-2009-0036—locallinux27 Apr 2009
Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.9 - 'nsTextFrame::ClearTextRun()' Remote Memory Corruption
CVE-2009-1313—doslinux27 Apr 2009
The nsTextFrame::ClearTextRun function in layout/generic/nsTextFrameThebes.cpp in Mozilla Firefox 3.0.9 allows remote at
23RISK
open ↗
Exploit-DB✓ VexDay Proof
SDP Downloader 2.3.0 - '.asx' Local Buffer Overflow (SEH) (2)
CVE-2009-1627—localwindows27 Apr 2009
Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MataChat - 'input.php' Multiple Cross-Site Scripting Vulnerabilities
CVE-2009-1620—webappsphp27 Apr 2009
Multiple cross-site scripting (XSS) vulnerabilities in input.php in MataChat allow remote attackers to inject arbitrary
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - Multiple Cross-Site Scripting Vulnerabilities
CVE-2009-1557—remotehardware25 Apr 2009
Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities
CVE-2009-1558—remotehardware23 Apr 2009
Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00
43RISK
open ↗
Exploit-DB✓ VexDay Proof
Mozilla (Multiple Products) - Server Refresh Header Cross-Site Scripting
CVE-2009-1312—remotelinux22 Apr 2009
Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, wh
23RISK
open ↗
Exploit-DB✓ VexDay Proof
DirectAdmin 1.33.3 - '/CMD_DB' Backup Action Insecure Temporary File Creation
CVE-2009-1526—locallinux22 Apr 2009
JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arb
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle RDBms 10.2.0.3/11.1.0.6 - TNS Listener (PoC)
CVE-2009-0991—doswindows21 Apr 2009
Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.
28RISK
open ↗
Exploit-DB✓ VexDay Proof
VS PANEL 7.3.6 - 'Cat_ID' SQL Injection
CVE-2009-3590—webappsphp21 Apr 2009
SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Sun Java System Delegated Administrator 6.x - HTTP Response Splitting
CVE-2009-1357—webappsjava21 Apr 2009
CRLF injection vulnerability in da/DA/Login in Sun Java System Delegated Administrator 6.2 through 6.4 allows remote att
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Trend Micro OfficeScan 8.0 Client - Denial of Service
CVE-2009-1435—doswindows21 Apr 2009
NTRtScan.exe in Trend Micro OfficeScan Client 8.0 SP1 and 8.0 SP1 Patch 1 allows local users to cause a denial of servic
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Online Contact Manager 3.0 - 'email.php?id' Cross-Site Scripting
CVE-2009-4926—webappsphp20 Apr 2009
Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
1by1 1.67 - '.m3u' Local Stack Overflow (PoC)
CVE-2009-4932—doswindows20 Apr 2009
Stack-based buffer overflow in 1by1 1.67 (aka 1.6.7.0) allows remote attackers to cause a denial of service (application
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Online Contact Manager 3.0 - 'index.php?showGroup' Cross-Site Scripting
CVE-2009-4926—webappsphp20 Apr 2009
Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
RedHat Stronghold Web Server 2.3 - Cross-Site Scripting
CVE-2009-1349—remotelinux20 Apr 2009
Cross-site scripting (XSS) vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WB News 2.1.2 - Insecure Cookie Handling
CVE-2009-4927—webappsphp20 Apr 2009
WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cook
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV < 1.4.1 - Local Privilege Escalation (1)
CVE-2009-1185—locallinux20 Apr 2009
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to ga
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Online Contact Manager 3.0 - 'edit.php?id' Cross-Site Scripting
CVE-2009-4926—webappsphp20 Apr 2009
Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote a
23RISK
open ↗
← previouspage 271 / 824next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.