Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Joomla! Component panoramic 1.0 - Remote File Inclusion
PHP remote file inclusion vulnerability in admin.panoramic.php in the Panoramic Picture Viewer (com_panoramic) mambot (p
35RISK
open ↗Exploit-DB✓ VexDay Proof
DropTeam 1.3.3 - Multiple Remote Vulnerabilities
Battlefront Dropteam 1.3.3 and earlier sends the client's online account name and password to the game server, which all
23RISK
open ↗Exploit-DB✓ VexDay Proof
AfterLogic MailBee WebMail Pro 3.x - 'login.php?mode' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - URI Handler Command Execution
The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 i
35RISK
open ↗Exploit-DB✓ VexDay Proof
Dawn of Time 1.69 MUD Server - Multiple Format String Vulnerabilities
Multiple format string vulnerabilities in websrv.cpp in Dawn of Time 1.69s beta4 and earlier allow remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pegasus Imaging ImagXpress 8.0 - Arbitrary File Overwrite
Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete
23RISK
open ↗Exploit-DB✓ VexDay Proof
AfterLogic MailBee WebMail Pro 3.x - 'default.asp?mode2' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Google FeedBurner FeedSmith 2.2 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cart32 6.x - GetImage Arbitrary File Download
c32web.exe in McMurtrey/Whitaker Cart32 before 6.4 allows remote attackers to read arbitrary files via the ImageName par
23RISK
open ↗Exploit-DB✓ VexDay Proof
Content Builder 0.7.5 - 'postComment.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Borland Interbase 2007/2007 SP2 - 'INET_connect' Remote Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0
50RISK
open ↗Exploit-DB✓ VexDay Proof
Borland Interbase 2007/2007 SP2 - 'open_marker_file' Remote Buffer Overflow (Metasploit)
Stack-based buffer overflow in Borland InterBase LI 8.0.0.53 through 8.1.0.253 on Linux, and possibly unspecified versio
50RISK
open ↗Exploit-DB✓ VexDay Proof
DRBGuestbook 1.1.13 - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Don Barnes DRBGuestbook 1.1.13 allows remote attackers to injec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Uebimiau Webmail 2.7.x - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Uebimiau 2.7.2 through 2.7.10 allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
Borland Interbase 2007 - 'PWD_db_aliased' Remote Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0
50RISK
open ↗Exploit-DB✓ VexDay Proof
Borland Interbase 2007/2007 SP2 - 'jrd8_create_database' Remote Buffer Overflow (Metasploit)
Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0
50RISK
open ↗Exploit-DB✓ VexDay Proof
id Software Doom 3 Engine - Console String Visualization Format String
Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.
23RISK
open ↗Exploit-DB✓ VexDay Proof
FSD 2.052/3.000 - 'servinterface.cc servinterface::sendmulticast' 'PIcallsign' Command Remote Overflow
Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
ASP Product Catalog 1.0 - 'default.asp' SQL Injection
SQL injection vulnerability in default.asp in ASP Product Catalog allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netkamp Emlak Scripti - Multiple Input Validation Vulnerabilities
SQL injection vulnerability in detay.asp in Netkamp Emlak Scripti allows remote attackers to execute arbitrary SQL comma
23RISK
open ↗Exploit-DB✓ VexDay Proof
FSD 2.052/3.000 - 'sysuser.cc sysuser::exechelp' 'HELP' Remote Overflow
Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ohesa Emlak Portal 1.0 - 'detay.asp?Emlak' SQL Injection
Multiple SQL injection vulnerabilities in Ohesa Emlak Portali allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ohesa Emlak Portal 1.0 - 'satilik.asp?Kategori' SQL Injection
Multiple SQL injection vulnerabilities in Ohesa Emlak Portali allow remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Tor < 0.1.2.16 - ControlPort Remote Rewrite
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
MD-Pro 1.0.76 - 'index.php' Firefox ID SQL Injection
SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQ
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.4/2.6 (x86-64) - System Call Emulation Privilege Escalation
The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5.0.1 - Arbitrary File Upload
The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field fo
28RISK
open ↗Exploit-DB✓ VexDay Proof
Novus 1.0 - 'Buscar.asp' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in buscar.asp in Solidweb Novus 1.0 allows remote attackers to inject arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
JSPWiki 2.5.139 - 'UserPreferences.jsp' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
JSPWiki 2.5.139 - 'Comment.jsp' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.