Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,496cataloged exploits
34,964CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,937VulnCheck XDB 8,510Nuclei 4,239Metasploit 3,468✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
Site2Ntite Vacation Rental (VRBO) Listings - SQL Injection
SQL injection vulnerability in detail.asp in Site2Nite Vacation Rental (VRBO) Listings allows remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
Site2Nite Business eListings - SQL Injection
SQL injection vulnerability in detail.asp in Site2Nite Business e-Listings allows remote attackers to execute arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
Online Work Order System (OWOS) Professional Edition - Authentication Bypass
SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10
23RISK
open ↗Exploit-DB✓ VexDay Proof
Online Work Order Suite - Login SQL Injection
SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Shiro - Directory Traversal
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the
35RISK
open ↗Exploit-DB✓ VexDay Proof
FUSE fusermount Tool - Race Condition
FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently u
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - 'Button' Arbitrary Code Execution (Metasploit)
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 o
50RISK
open ↗Exploit-DB
Collabtive 0.65 - SQL Injection
SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL comman
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin cformsII 11.5/13.1 - 'lib_ajax.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin
23RISK
open ↗Exploit-DB
Yaws 1.89 - Directory Traversal
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslas
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Pulse Infotech Flip Wall - SQL Injection
SQL injection vulnerability in the Pulse Infotech Flip Wall (com_flipwall) component 1.1 for Joomla! allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Sponsor Wall 1.1 - SQL Injection
SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.6.8 < 3.6.11 - Interleaving 'document.write' / 'appendChild' Remote Overflow
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, a
100RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - Interleaving 'document.write' / 'appendChild' Denial of Service
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, a
100RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox - Simplified Memory Corruption (PoC)
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, a
100RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.36 - VIDIOCSMICROCODE IOCTL Local Memory Overwrite
drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 6
23RISK
open ↗Exploit-DB✓ VexDay Proof
Alstrasoft e-Friends 4.96 - Multiple Vulnerabilities
SQL injection vulnerability in index.php in AlstraSoft Web Email Script Enterprise (ESE) allows remote attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Energine CMS - SQL Injection
SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
BloofoxCMS Registration Plugin - SQL Injection
SQL injection vulnerability in index.php in BloofoxCMS 0.3.5 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
NinkoBB 1.3RC5 - Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in users.php in NinkoBB 1.3 RC5 allow remote attackers to inject arb
23RISK
open ↗Exploit-DB✓ VexDay Proof
DATAC RealWin SCADA Server 1.06 - Remote Buffer Overflow
Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a
50RISK
open ↗Exploit-DB✓ VexDay Proof
ACC IMoveis 4.0 - SQL Injection
SQL injection vulnerability in imoveis.php in DescargarVista ACC IMoveis 1.1 allows remote attackers to execute arbitrar
23RISK
open ↗Exploit-DB
NitroSecurity ESM 8.4.0a - Remote Code Execution
ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary c
23RISK
open ↗Exploit-DB✓ VexDay Proof
NitroView ESM - 'ess.pm' Remote Command Execution
ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary c
23RISK
open ↗Exploit-DB✓ VexDay Proof
Winamp 5.5.8.2985 (in_mod plugin) - Local Stack Overflow
Buffer overflow in the in_mod plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vect
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM Server Virtual Server Agent - Command Injection (Metasploit)
Unspecified vulnerability in the OracleVM component in Oracle VM 2.2.1 allows remote authenticated users to affect confi
50RISK
open ↗Exploit-DB✓ VexDay Proof
DBHcms 1.1.4 - 'dbhcms_pid' SQL Injection
SQL injection vulnerability in index.php in DBHcms 1.1.4 allows remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Tivoli Access Manager for E-Business - '/ibm/wpm/rule?method' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Tivoli Access Manager for E-Business - '/ibm/wpm/pop?method' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Tivoli Access Manager for E-Business - '/ibm/wpm/group?method' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.