Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
81,056cataloged exploits
37,663CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 24,044GitHub PoC 15,516VulnCheck XDB 9,077Nuclei 4,432Metasploit 3,505✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5.0.1 - FTP URI Arbitrary FTP Server Command Execution
CRLF injection vulnerability in Microsoft Internet Explorer 6.0.2800.1106 and earlier allows remote attackers to execute
35RISK
open ↗Exploit-DB✓ VexDay Proof
KDE FTP - KIOSlave URI Arbitrary FTP Server Command Execution
Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded
23RISK
open ↗Exploit-DB✓ VexDay Proof
Hosting Controller 0.6.1 Hotfix 1.4 - Directory Browsing
Hosting Controller 6.1 Hotfix 1.4, and possibly other versions, allows remote attackers to view arbitrary directories by
23RISK
open ↗Exploit-DB✓ VexDay Proof
PAFileDB 3.1 - Error Message Full Path Disclosure
paFileDB 3.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) auth.php, (
23RISK
open ↗Exploit-DB✓ VexDay Proof
Advanced Guestbook 2.2/2.3 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in index.php in Advanced Guestbook 2.3.1, 2.2, and possibly other versions allo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kreed 1.05 - Format String / Denial of Service
Format string vulnerability in Kreed 1.05 and earlier allows remote attackers to execute arbitrary code via format speci
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kreed 1.05 - Format String / Denial of Service
The scripts that handle players in Kreed 1.05 and earlier allow remote attackers to cause a denial of service (server fr
23RISK
open ↗Exploit-DB✓ VexDay Proof
Blog Torrent 0.8 - Directory Traversal
Directory traversal vulnerability in btdownload.php in Blog Torrent preview 0.8 allows remote attackers to download arbi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Kreed 1.05 - Format String / Denial of Service
Kreed 1.05 and earlier allows remote attackers to cause a denial of service (server disconnect) via a long UDP packet, w
23RISK
open ↗Exploit-DB✓ VexDay Proof
RSSH 2.x - Arbitrary Command Execution
rssh 2.2.2 and earlier does not properly restrict programs that can be run, which could allow remote authenticated users
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (2)
Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Aspell (word-list-compress) - Command Line Stack Overflow
Multiple stack-based buffer overflows in the word-list-compress functionality in compress.c for Aspell allow local users
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (2)
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01a - 'check' Buffer Overflow
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01a - 'check' Buffer Overflow
Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via
23RISK
open ↗Exploit-DB✓ VexDay Proof
IPCop 1.4.1 - Web Administration Interface Proxy Log HTML Injection
Cross-site scripting (XSS) vulnerability in proxylog.dat in IPCop 1.4.1 and possibly other versions, allows remote attac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (1)
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of
60RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (1)
Buffer overflow in the IMAP service of Mercury (Pegasus) Mail 4.01 allows remote attackers to execute arbitrary code via
23RISK
open ↗Exploit-DB✓ VexDay Proof
Orbz Game 2.10 - Remote Buffer Overflow (PoC)
Buffer overflow in Orbz 2.10 and earlier allows remote attackers to cause a denial of service (application crash) and po
23RISK
open ↗Exploit-DB✓ VexDay Proof
Ipswitch WS_FTP Server 5.03 - 'RNFR' Buffer Overflow
Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE, (2) MDT
35RISK
open ↗Exploit-DB✓ VexDay Proof
Ipswitch WS_FTP Server 5.03 - MKD Remote Buffer Overflow
Multiple buffer overflows in WS_FTP Server 5.03 2004.10.14 allow remote attackers to cause a denial of service (service
50RISK
open ↗Exploit-DB✓ VexDay Proof
Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3)
Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of
60RISK
open ↗Exploit-DB✓ VexDay Proof
File ELF 4.x - Header Buffer Overflow
Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary cod
28RISK
open ↗Exploit-DB✓ VexDay Proof
PHP 4.3.7/5.0.0RC3 - 'memory_limit' Remote Overflow
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when reg
35RISK
open ↗Exploit-DB✓ VexDay Proof
pntresmailer 6.0 - Directory Traversal
Directory traversal vulnerability in codebrowserpntm.php in pnTresMailer 6.0.3 allows remote attackers to read arbitrary
23RISK
open ↗Exploit-DB✓ VexDay Proof
MailEnable Mail Server IMAP 1.52 - Remote Buffer Overflow
Buffer overflow in the IMAP service of MailEnable Professional Edition 1.52 and Enterprise Edition 1.01 allows remote at
28RISK
open ↗Exploit-DB✓ VexDay Proof
Alex Heiphetz Group eZshopper - 'loadpage.cgi' Directory Traversal
EZShopper 3.0 loadpage.cgi CGI script allows remote attackers to read arbitrary files via a .. (dot dot) attack or execu
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.4.x/2.6.x - Local Denial of Service / Memory Disclosure
The binfmt functionality in the Linux kernel, when "memory overcommit" is enabled, allows local users to cause a denial
23RISK
open ↗Exploit-DB✓ VexDay Proof
InShop and InMail - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in inmail.pl in Insite Inmail allows remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB✓ VexDay Proof
Winamp 5.06 - 'IN_CDDA.dll' Remote Buffer Overflow
Stack-based buffer overflow in IN_CDDA.dll in Winamp 5.05, and possibly other versions including 5.06, allows remote att
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.