Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
24,446 exploits
Exploit-DB✓ VexDay Proof
phpPollScript 1.3 - 'include_class' Remote File Inclusion
PHP remote file inclusion vulnerability in php/init.poll.php in phpPollScript 1.3 and earlier, when register_globals is
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.31 - 'perf_counter_open()' Local Buffer Overflow
Buffer overflow in the perf_copy_attr function in kernel/perf_counter.c in the Linux kernel 2.6.31-rc1 allows local user
23RISK
open ↗Exploit-DB✓ VexDay Proof
BigAnt Server 2.50 SP1 - '.zip' Local Buffer Overflow (PoC)
Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mega File Hosting Script 1.2 - 'emaillinks.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 all
23RISK
open ↗Exploit-DB✓ VexDay Proof
PaoBacheca 2.1 - 'scrivi.php' URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Zenas PaoBacheca Guestbook 2.1 allow remote attackers to inject a
23RISK
open ↗Exploit-DB✓ VexDay Proof
AdsDX 3.05 - Authentication Bypass
SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component com_foobla_suggestions (idea_id) 1.5.11 - SQL Injection
SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remot
23RISK
open ↗Exploit-DB✓ VexDay Proof
RSSMediaScript - 'index.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in RSSMediaScript allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
PaoBacheca 2.1 - 'index.php' URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Zenas PaoBacheca Guestbook 2.1 allow remote attackers to inject a
23RISK
open ↗Exploit-DB✓ VexDay Proof
NetBSD 5.0.1 - 'IRET' General Protection Fault Handling Privilege Escalation
The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the
23RISK
open ↗Exploit-DB✓ VexDay Proof
HotWeb Rentals - 'details.asp?PropId' Blind SQL Injection
SQL injection vulnerability in details.asp in HotWeb Rentals allows remote attackers to execute arbitrary SQL commands v
23RISK
open ↗Exploit-DB✓ VexDay Proof
BigAnt Server 2.50 - GET Universal Remote Buffer Overflow (SEH)
Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to
50RISK
open ↗Exploit-DB✓ VexDay Proof
BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to
50RISK
open ↗Exploit-DB✓ VexDay Proof
efront 3.5.4 - 'database.php?path' Remote File Inclusion
PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is
23RISK
open ↗Exploit-DB✓ VexDay Proof
Wireshark 1.2.1 - TLS Dissector 1.2 Conversation Handling Remote Denial of Service
Unspecified vulnerability in the TLS dissector in Wireshark 1.2.0 and 1.2.1, when running on Windows, allows remote atta
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component com_djcatalog - SQL Injection / Blind SQL Injection
Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Wireshark 1.2.1 - GSM A RR Dissector packet.c Remote Denial of Service
Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
FileCOPA FTP Server 5.01 - 'NOOP' Denial of Service
FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafte
23RISK
open ↗Exploit-DB✓ VexDay Proof
MP3 Collector 2.3 - '.m3u' Local Crash (PoC)
MP3 Collector 2.3 allows remote attackers to cause a denial of service (application crash) via a long URL in a .m3u play
23RISK
open ↗Exploit-DB✓ VexDay Proof
VideoLAN VLC Media Player < 0.9.6 - 'CUE' Local Buffer Overflow (PoC)
Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to exec
28RISK
open ↗Exploit-DB✓ VexDay Proof
DJ Studio Pro 4.2 - '.pls' Local Crash
Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-as
50RISK
open ↗Exploit-DB✓ VexDay Proof
BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows r
60RISK
open ↗Exploit-DB✓ VexDay Proof
HERO SUPER PLAYER 3000 - '.m3u' Buffer Overflow (PoC)
Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly exec
23RISK
open ↗Exploit-DB✓ VexDay Proof
Novell Groupwise Client 7.0.3.1294 - ActiveX Denial of Service (PoC)
Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause
23RISK
open ↗Exploit-DB✓ VexDay Proof
BigAnt Server 2.50 - GET Universal Remote Buffer Overflow (SEH)
Stack-based buffer overflow in the AntServer module (AntServer.exe) in BigAnt IM Server in BigAnt Messenger 2.2 allows r
60RISK
open ↗Exploit-DB✓ VexDay Proof
Wireshark 1.2.1 - OpcUa Dissector Resource Exhaustion (Denial of Service)
Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
EasyMail Quicksoft 6.0.2.0 - CreateStore ActiveX Code Execution (PoC)
Buffer overflow in emmailstore.dll 6.5.0.3 in the QuikSoft EasyMail MailStore ActiveX control allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Shockwave Player 11.5.1.601 - ActiveX Buffer Overflow (PoC)
Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remo
28RISK
open ↗Exploit-DB✓ VexDay Proof
NetAccess IP3 - (Authenticated) Ping Option Command Injection
na-img-4.0.34.bin for the IP3 Networks NetAccess NA75 allows local users to gain Unix shell access via "`" (backtick) ch
23RISK
open ↗Exploit-DB✓ VexDay Proof
Aurora CMS 1.0.2 - 'install.plugin.php' Remote File Inclusion
PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 all
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.