Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
81,524cataloged exploits
37,962CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 24,284GitHub PoC 15,675VulnCheck XDB 9,136Nuclei 4,441Metasploit 3,506✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
IBM AIX 4.x - '/usr/bin/setsenv' Local Buffer Overflow
Buffer overflow in setsenv command in IBM AIX 4.3.x and earlier allows local users to execute arbitrary commands via a l
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_showcolv Buffer Overflow
The xp_showcolv function in SQL Server and Microsoft SQL Server Desktop Engine (MSDE) does not properly restrict the len
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHF (Linux/x86) - Remote Buffer Overflow
Buffer overflow in phf CGI program allows remote attackers to execute arbitrary commands by specifying a large number of
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft SQL Server 7.0/2000 / Data Engine 1.0/2000 - xp_peekqueue Buffer Overflow
The xp_peekqueue function in Microsoft SQL Server 2000 and SQL Server Desktop Engine (MSDE) does not properly restrict t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris sadmind - Remote Buffer Overflow
Buffer overflow in Solaris sadmind allows remote attackers to gain root privileges using a NETMGT_PROC_SERVICE request.
28RISK
open ↗Exploit-DB✓ VexDay Proof
GLIBC - '/bin/su' Local Privilege Escalation
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which
28RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 2.6/7.0 - 'locale' Format Strings noexec stack Overflow
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which
28RISK
open ↗Exploit-DB✓ VexDay Proof
Trlinux Postaci Webmail 1.1.3 - Password Disclosure
The default configuration for PostACI webmail system installs the /includes/global.inc configuration file within the web
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Net.Data 7.0 - Full Path Disclosure
document.d2w CGI program in the IBM Net.Data db2www package allows remote attackers to determine the physical path of th
23RISK
open ↗Exploit-DB✓ VexDay Proof
dump 0.4b15 (RedHat 6.2) - Local Privilege Escalation
dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Caucho Technology Resin 1.2 - JSP Source Disclosure
Caucho Technology Resin 1.2 and possibly earlier allows remote attackers to view JSP source via an HTTP request to a .js
23RISK
open ↗Exploit-DB✓ VexDay Proof
Network Associates Webshield SMTP 4.5 - Invalid Outgoing Recipient Field Denial of Service
McAfee WebShield SMTP 4.5 allows remote attackers to cause a denial of service via a malformed recipient field.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 7.0 - '.wms' Arbitrary Script (MS00-090)
Microsoft Windows Media Player 7 executes scripts in custom skin (.WMS) files, which could allow remote attackers to gai
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsys CyberPatrol 4.0 4.003/4.0 4.005 - Insecure Registration
Microsys CyberPatrol uses weak encryption (trivial encoding) for credit card numbers and uses no encryption for the rema
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Player 7.0 - '.asx' Remote Buffer Overflow
Buffer overflow in Microsoft Windows Media Player allows remote attackers to execute arbitrary commands via a malformed
28RISK
open ↗Exploit-DB✓ VexDay Proof
Unify eWave ServletExec 3 - .JSP Source Disclosure
Unify ServletExec AS v3.0C allows remote attackers to read source code for JSP pages via an HTTP request that ends with
23RISK
open ↗Exploit-DB✓ VexDay Proof
BSDi SUIDPerl - Local Stack Buffer Overflow
Buffer overflow in suidperl (sperl), Perl 4.x and 5.x.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 2.x/7.0/8 - 'Catman' Race Condition (2)
catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID tempo
23RISK
open ↗Exploit-DB✓ VexDay Proof
WU-FTPD 2.6.0 - Remote Command Execution
The lreply function in wu-ftpd 2.6.0 and earlier does not properly cleanse an untrusted format string, which allows remo
60RISK
open ↗Exploit-DB✓ VexDay Proof
BSDi 3.0/4.0 - 'rcvtty[mh]' Local Privilege Escalation
rcvtty in BSD 3.0 and 4.0 does not properly drop privileges before executing a script, which allows local attackers to g
23RISK
open ↗Exploit-DB✓ VexDay Proof
vixie-cron - Local Privilege Escalation
crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is own
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 2.x/7.0/8 - 'Catman' Race Condition (1)
catman in Solaris 2.7 and 2.8 allows local users to overwrite arbitrary files via a symlink attack on the sman_PID tempo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle 8.x - cmctl Buffer Overflow
Buffer overflow in cmctl program in Oracle 8.1.5 Connection Manager Control allows local users to gain privileges via a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jan Hubicka Koules 1.4 - 'Svgalib' Local Buffer Overflow
Buffer overflow in Koules 1.4 allows local users to execute arbitrary commands via a long command line argument.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Markus Triska CGIForum 1.0 - 'thesection' Directory Traversal
Directory traversal vulnerability in cgiforum.pl script in CGIForum 1.0 allows remote attackers to ready arbitrary files
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris/SPARC 2.7 / 7 locale - Format String
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which
28RISK
open ↗Exploit-DB✓ VexDay Proof
BB4 Big Brother Network Monitor 1.5 d2 - 'bb-hist.sh?HISTFILE' File Existence Disclosure
bb-hist.sh, bb-histlog.sh, bb-hostsvc.sh, bb-rep.sh, bb-replog.sh, and bb-ack.sh in Big Brother (BB) before 1.5d3 allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
dump 0.4b15 - Local Privilege Escalation
dump in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to o
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP-UX 11.00/10.20 crontab - Overwrite Files
HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target fil
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)
IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary comman
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.