Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
19,067 exploits
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer - Recordset Double-Free Memory (MS07-009)
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mephisto Blog 0.7.3 - Search Function Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTM
23RISK
open ↗Exploit-DB✓ VexDay Proof
WarFTP 1.65 - 'USER' Remote Buffer Overflow
Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of s
35RISK
open ↗Exploit-DB✓ VexDay Proof
Asterisk 1.2.16/1.4.1 - SIP INVITE Remote Denial of Service
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service
28RISK
open ↗Exploit-DB✓ VexDay Proof
Frontbase 4.2.7 (Windows) - Remote Buffer Overflow
Buffer overflow in FrontBase Relational Database Server 4.2.7 and earlier allows remote authenticated users, with privil
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow
The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session vari
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP < 4.4.5/5.2.1 - '_SESSION' Deserialization Overwrite
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.0.1 - 'LOGIN' Remote IMAP Stack Buffer Overflow
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of
60RISK
open ↗Exploit-DB✓ VexDay Proof
Free File Hosting System 1.1 - 'contact.php?AD_BODY_TEMP' Remote File Inclusion
PHP remote file inclusion vulnerability in contact.php in Free File Hosting 1.1 and earlier allows remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
Free File Hosting System 1.1 - 'register.php?AD_BODY_TEMP' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register_globals
23RISK
open ↗Exploit-DB✓ VexDay Proof
Free File Hosting System 1.1 - 'login.php?AD_BODY_TEMP' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Free File Hosting 1.1, and possibly earlier, when register_globals
23RISK
open ↗Exploit-DB✓ VexDay Proof
MzK Blog - 'Katgoster.asp' SQL Injection
SQL injection vulnerability in katgoster.asp in MzK Blog (tr) allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.2.1 - 'Unserialize()' Local Information Leak
PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a seriali
23RISK
open ↗Exploit-DB✓ VexDay Proof
eWebquiz 8 - 'eWebQuiz.asp' SQL Injection
SQL injection vulnerability in eWebQuiz.asp in ActiveWebSoftwares.com eWebquiz 8 allows remote attackers to execute arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
dproxy 0.5 - Remote Buffer Overflow (Metasploit)
Stack-based buffer overflow in dproxy.c for dproxy 0.1 through 0.5 allows remote attackers to execute arbitrary code via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ethernet Device Drivers Frame Padding - 'Etherleak' Infomation Leakage
Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote att
45RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Vista - Windows Mail Local File Execution
Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a lin
35RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.0.x/2.2.x/2.4.x (FreeBSD 4.x) - Network Device Driver Frame Padding Information Disclosure
Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote att
45RISK
open ↗Exploit-DB✓ VexDay Proof
Opera 9.x - FTP PASV Port-Scanning
The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla FireFox 1.5.x/2.0 - FTP PASV Port-Scanning
The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to for
28RISK
open ↗Exploit-DB✓ VexDay Proof
Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (1)
Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in As
28RISK
open ↗Exploit-DB✓ VexDay Proof
KDE Konqueror 3.x/IOSlave - FTP PASV Port-Scanning
The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers
23RISK
open ↗Exploit-DB✓ VexDay Proof
Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (2)
Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in As
28RISK
open ↗Exploit-DB✓ VexDay Proof
Grandstream Budge Tone-200 IP Phone - Digest domain Denial of Service
The Grandstream BudgeTone 200 IP phone, with program 1.1.1.14 and bootloader 1.1.1.5, allows remote attackers to cause a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mercur Messaging 2005 < SP4 - IMAP Remote (Egghunter)
Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause
50RISK
open ↗Exploit-DB✓ VexDay Proof
W-Agora 4.2.1 - 'change_password.php?userid' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
W-Agora 4.2.1 - 'profile.php?showuser' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
Web Wiz Forums 8.05 - String Filtering SQL Injection
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not p
23RISK
open ↗Exploit-DB✓ VexDay Proof
FTPDMIN 0.96 - 'LIST' Remote Denial of Service
FTPDMIN 0.96 allows remote attackers to cause a denial of service (daemon crash) via a LIST command for a Windows drive
23RISK
open ↗Exploit-DB✓ VexDay Proof
Cisco Phone 7940/7960 - 'SIP INVITE' Remote Denial of Service
Unspecified vulnerability in the Cisco IP Phone 7940 and 7960 running firmware before POS8-6-0 allows remote attackers t
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.