Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,302cataloged exploits
35,469CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,141VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
24,451 exploits
Exploit-DB✓ VexDay Proof
Larson Network Print Server 9.4.2 build 105 - 'LstNPS' Logging Function USEP Command Remote Format String
Format string vulnerability in the logging function in Larson Network Print Server (LstNPS) 9.4.2 build 105 and earlier
23RISK
open ↗Exploit-DB✓ VexDay Proof
Opium OPI Server and CyanPrintIP - Format String / Denial of Service
Format string vulnerability in the ReportSysLogEvent function in the LPD server in cyan soft Opium OPI Server 4.10.1028
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sentinel Protection Server 7.x/Keys Server 1.0.x - Backslash Directory Traversal
Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.4.1.0 and earlier, and Sentinel Keys Server 1.
23RISK
open ↗Exploit-DB✓ VexDay Proof
F5 BIG-IP 9.4.3 - Web Management Interface Cross-Site Request Forgery
Web Management Console Cross-site request forgery (CSRF) vulnerability in the web management console in F5 BIG-IP 9.4.3
23RISK
open ↗Exploit-DB✓ VexDay Proof
cyan soft - Multiple Applications Format String / Denial of Service Vulnerabilities
The LPD server in cyan soft Opium OPI Server 4.10.1028 and earlier; cyanPrintIP Easy OPI, Professional, and Basic 4.10.1
23RISK
open ↗Exploit-DB✓ VexDay Proof
Group Logic ExtremeZ-IP File and Print Servers 5.1.2 x15 - Multiple Vulnerabilities
ExtremeZ-IP.exe in ExtremeZ-IP File and Print Server 5.1.2x15 and earlier does not verify that a certain "number of URLs
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)
The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain users
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2)
The copy_from_user_mmap_sem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certai
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.23 < 2.6.24 - 'vmsplice' Local Privilege Escalation (1)
The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain users
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure
Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double q
35RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.23 < 2.6.24 - 'vmsplice' Local Privilege Escalation (1)
The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo
23RISK
open ↗Exploit-DB✓ VexDay Proof
IEA Software (Multiple Products) - POST Denial of Service
The web server in IEA Software RadiusNT and RadiusX 5.1.38 and other versions before 5.1.44, Emerald 5.0.49 and other ve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joovili 2.1 - 'members_help.php' Remote File Inclusion
PHP remote file inclusion vulnerability in members_help.php in Joovili 2.1 and earlier allows remote attackers to execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
S9Y Serendipity Freetag-plugin 2.95 - 'style' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Expl
23RISK
open ↗Exploit-DB✓ VexDay Proof
Managed Workplace Service Center 4.x/5.x/6.x - Installation Information Disclosure
Level Platforms, Inc. (LPI) Managed Workplace Service Center 4.x, 5.x and 6.x allows remote attackers to obtain sensitiv
23RISK
open ↗Exploit-DB✓ VexDay Proof
Calimero.CMS 3.3 - 'id' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Calimero.CMS 3.3 allows remote attackers to inject arbitrary we
23RISK
open ↗Exploit-DB✓ VexDay Proof
MODx 0.9.6 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject ar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ipswitch Instant Messaging 2.0.8.1 - Multiple Vulnerabilities
Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote attackers to cause a denial of service (NULL dereferen
28RISK
open ↗Exploit-DB✓ VexDay Proof
MyNews 1.6.x - 'hash' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mynews.inc.php in MyNews 1.6.4, and other earlier 1.6.x versions, allows rem
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ipswitch WS_FTP Server 6 - '/WSFTPSVR/FTPLogServer/LogViewer.asp' Authentication Bypass
Ipswitch WS_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass aut
28RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Acrobat and Reader 8.1.1 - Multiple Arbitrary Code Execution / Security Vulnerabilities
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code
100RISK
open ↗Exploit-DB✓ VexDay Proof
TinTin++ / WinTin++ 1.97.9 - '#chat' Multiple Vulnerabilities
Stack-based buffer overflow in the add_line_buffer function in TinTin++ 1.97.9 and WinTin++ 1.97.9 allows remote attacke
28RISK
open ↗Exploit-DB✓ VexDay Proof
Pagetool 1.07 - 'search_term' Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Works 8.0 - File Converter Field Length Remote Code Execution
Stack-based buffer overflow in wkcvqd01.dll in Microsoft Works 6 File Converter, as used in Office 2003 SP2 and SP3, Wor
35RISK
open ↗Exploit-DB✓ VexDay Proof
Portail Web PHP 2.5.1 - 'item.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrar
35RISK
open ↗Exploit-DB✓ VexDay Proof
Simple OS CMS 0.1c_beta - 'login.php' SQL Injection
SQL injection vulnerability in login.php in Simple OS CMS 0.1c beta allows remote attackers to execute arbitrary SQL com
23RISK
open ↗Exploit-DB✓ VexDay Proof
WinComLPD Total 3.0.2.623 - Remote Buffer Overflow / Authentication Bypass
Integer overflow in the remote administration protocol processing in Client Software WinCom LPD Total 3.0.2.623 and earl
50RISK
open ↗Exploit-DB✓ VexDay Proof
AstroSoft HelpDesk - '/operator/article/article_search_results.asp?txtSearch' Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in AstroSoft HelpDesk before 1.95.228 allow remote attackers to inje
23RISK
open ↗Exploit-DB✓ VexDay Proof
Portail Web PHP 2.5.1 - 'conf_modules.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrar
35RISK
open ↗Exploit-DB✓ VexDay Proof
Portail Web PHP 2.5.1 - 'conf-activation.php' Remote File Inclusion
Multiple PHP remote file inclusion vulnerabilities in Portail Web Php 2.5.1.1 allow remote attackers to execute arbitrar
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.