Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,324cataloged exploits
37,130CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,614GitHub PoC 15,330VulnCheck XDB 9,001Nuclei 4,401Metasploit 3,502✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
ICQ 6 - 'Personal Status Manager' Remote Buffer Overflow (PoC)
Heap-based buffer overflow in the boxelyRenderer module in the Personal Status Manager feature in ICQ 6.0 build 6043 all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Istant-Replay - 'read.php' Remote File Inclusion
PHP remote file inclusion vulnerability in read.php in Chattaitaliano Istant-Replay allows remote attackers to execute a
23RISK
open ↗Exploit-DB✓ VexDay Proof
W2B Online Banking - 'ilang' Remote File Inclusion
PHP remote file inclusion vulnerability in index.php in W2B Online Banking allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
amfPHP 1.2 - '/browser/methodTable.php?class' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
amfPHP 1.2 - '/browser/details?class' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
amfPHP 1.2 - '/browser/code.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in AMFPHP 1.2 allow remote attackers to inject arbitrary web script
23RISK
open ↗Exploit-DB✓ VexDay Proof
LightNEasy sqlite / no database 1.2.2 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cezanne 6.5.1/7 - 'home.asp?CFTARGET' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cezanne 7 - '/CznCommon/CznCustomContainer.asp?FUNID' SQL Injection
Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cezanne 7 - 'cflookup.asp?FUNID' SQL Injection
Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cezanne 6.5.1/7 - 'CznCustomContainer.asp' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cezanne Software 6.5.1/7 - 'CFLogon.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in CFLogon/CFLogon.asp in Cezanne 6.5.1 and 7 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cezanne 6.5.1/7 - 'cflookup.asp' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
osCommerce Poll Booth 2.0 AddOn - 'pollbooth.php' SQL Injection
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
W2B PHPHotResources - 'cat.php' SQL Injection
SQL injection vulnerability in cat.php in W2B phpHotResources allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
Trillian 3.1.9 - '.DTD' File XML Parser Buffer Overflow
Buffer overflow in the XML parser in Trillian 3.1.9.0, and possibly earlier, allows remote attackers to cause a denial o
23RISK
open ↗Exploit-DB✓ VexDay Proof
W2B Dating Club - 'browse.php' SQL Injection
SQL injection vulnerability in browse.php in W2B DatingClub (aka Dating Club) allows remote attackers to execute arbitra
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP OpenView Network Node Manager (OV NNM) 7.x - 'OpenView5.exe?Action' Traversal Arbitrary File Access
Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 all
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pragmatic Utopia PU Arcade 2.2 - 'gid' SQL Injection
SQL injection vulnerability in puarcade.class.php 2.2 and earlier in the Pragmatic Utopia PU Arcade (com_puarcade) compo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft SharePoint Server 2.0 - Picture Source HTML Injection
Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Python zlib Module - Remote Buffer Overflow
Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arb
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows XP/Vista/2000/2003/2008 Kernel - Usermode Callback Privilege Escalation (MS08-025) (1)
Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, through Vista SP
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP OpenView Network Node Manager 7.x - 'ovspmd' Buffer Overflow
Integer signedness error in ovspmd.exe in HP OpenView Network Node Manager (OV NNM) 8.01, and 7.53 and earlier, allows r
28RISK
open ↗Exploit-DB✓ VexDay Proof
Swiki 1.5 - HTML Injection / Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Swiki 1.5 allow remote attackers to inject arbitrary web script o
23RISK
open ↗Exploit-DB✓ VexDay Proof
LICQ 1.3.5 - File Descriptor Remote Denial of Service
licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player 8/9.0.x - '.SWF' File 'DeclareFunction2' ActionScript Tag Remote Code Execution
Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code vi
35RISK
open ↗Exploit-DB✓ VexDay Proof
HP OpenView Network Node Manager (OV NNM) 7.53 - Multiple Vulnerabilities
Multiple stack-based buffer overflows in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.51, and possibly 7.01
28RISK
open ↗Exploit-DB✓ VexDay Proof
URLStreet 1.0 - 'seeurl.php' Multiple Cross-Site Scripting Vulnerabilities
Cross-site scripting (XSS) vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blog PixelMotion - 'sauvBase.php' Arbitrary Database Backup
admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
SCO UnixWare < 7.1.4 p534589 - 'pkgadd' Local Privilege Escalation
Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privilege
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.