Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Apple Safari 3.2.2 - 'feed:' URI Multiple Input Validation Vulnerabilities
Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7
23RISK
open ↗Exploit-DB✓ VexDay Proof
CastRipper 2.50.70 - '.pls' Universal Stack Overflow
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a lo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Compress::Raw::Zlib Perl Module - Remote Code Execution
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS,
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 5.3.2 - 'xml_utf8_decode()' UTF-8 Input Validation
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed su
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey befor
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.10 - 'nsViewManager.cpp' Denial of Service
nsViewManager.cpp in Mozilla Firefox 3.0.2 through 3.0.10 allows remote attackers to cause a denial of service (NULL poi
23RISK
open ↗Exploit-DB✓ VexDay Proof
MPLAB IDE 8.30 - '.mcp' Universal Overwrite (SEH)
Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox 3.0.x - Large '.GIF' File Background Denial of Service
Mozilla Firefox 3.0.10 and earlier on Linux allows remote attackers to cause a denial of service (application crash) via
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - XML External Entity Information Disclosure
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for i
28RISK
open ↗Exploit-DB✓ VexDay Proof
Claroline 1.8.11 - '/claroline/linker/notfound.php' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - JavaScript 'onload()' Event Cross Domain Scripting
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone O
23RISK
open ↗Exploit-DB✓ VexDay Proof
GrabIt 1.7.2x - NZB DTD Reference Buffer Overflow
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to ex
23RISK
open ↗Exploit-DB✓ VexDay Proof
Verlihub Control Panel 1.7 - Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Almond Classifieds 5.6.2 - Blind SQL Injection
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary co
23RISK
open ↗Exploit-DB✓ VexDay Proof
Git 1.6.3 - Parameter Processing Remote Denial of Service
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU cons
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Woodstock 4.2 404 - Error Page Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in ThemeServlet.java in Sun Woodstock 4.2, as used in Sun GlassFish Enterprise
23RISK
open ↗Exploit-DB✓ VexDay Proof
VerliAdmin 0.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to
23RISK
open ↗Exploit-DB✓ VexDay Proof
GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sorinara Streaming Audio Player 0.9 - '.m3u' Local Stack Overflow (PoC)
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary co
23RISK
open ↗Exploit-DB✓ VexDay Proof
TemaTres 1.0.3 - Authentication Bypass / SQL Injection / Cross-Site Scripting
Multiple SQL injection vulnerabilities in TemaTres 1.031, when magic_quotes_gpc is disabled, allow remote attackers to e
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.