Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Linux Kernel 2.2 - Predictable TCP Initial Sequence Number
Cisco AP340 base station produces predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2 - Predictable TCP Initial Sequence Number
WinCE 3.0.9348 generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hija
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5.0/4.0.1 - hhopen OLE Control Buffer Overflow
Buffer overflow in HHOpen ActiveX control (hhopen.ocx) 1.0.0.1 for Internet Explorer 4.01 and 5 allows remote attackers
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2 - Predictable TCP Initial Sequence Number
Symantec Raptor Firewall 6.5 and 6.5.3, Enterprise Firewall 6.5.2 and 7.0, VelociRaptor Models 500/700/1000 and 1100/120
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2 - Predictable TCP Initial Sequence Number
TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.2 - Predictable TCP Initial Sequence Number
Predictable TCP sequence numbers allow spoofing.
35RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Acrobat ActiveX Control 1.3.188 - ActiveX Buffer Overflow
Buffer overflow in Adobe Acrobat ActiveX control (pdf.ocx, PDF.PdfCtrl.1) 1.3.188 for Acrobat Reader 4.0 allows remote a
28RISK
open ↗Exploit-DB✓ VexDay Proof
Knox Arkeia 4.0 Backup - Local Overflow
Buffer overflow in (1) nlservd and (2) rnavc in Knox Software Arkeia backup product allows local users to obtain root ac
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mandriva Linux Mandrake 6.0 / Gnome Libs 1.0.8 - 'espeaker' Local Buffer Overflow
Buffer overflow in GNOME libraries 1.0.8 allows local user to gain root access via a long --espeaker argument in program
23RISK
open ↗Exploit-DB✓ VexDay Proof
NCSA 1.3/1.4.x/1.5 / Apache HTTPd 0.8.11/0.8.14 - ScriptAlias Source Retrieval
ScriptAlias directory in NCSA and Apache httpd allowed attackers to read CGI programs.
28RISK
open ↗Exploit-DB✓ VexDay Proof
SuSE Linux 6.2 sscw - HOME Environment Variable Buffer Overflow
Buffer overflow in sccw allows local users to gain root access via the HOME environmental variable.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 7.0 - Recursive mutex_enter Remote Panic (Denial of Service)
Denial of service in Solaris TCP streams driver via a malicious connection that causes the server to panic as a result o
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 2.6 - Profiling File Creation
The dynamic linker in Solaris allows a local user to create arbitrary files via the LD_PROFILE environmental variable an
23RISK
open ↗Exploit-DB✓ VexDay Proof
FreeBSD 3.0/3.1/3.2 - 'vfs_cache' Denial of Service
FreeBSD VFS cache (vfs_cache) allows local users to cause a denial of service by opening a large number of files.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Martin Schulze Cfingerd 1.4.2 - GECOS Buffer Overflow
Buffer overflow in cfingerd allows local users to gain root privileges via a long GECOS field.
23RISK
open ↗Exploit-DB✓ VexDay Proof
SSH Communications Security SSH 1.2.27 - Authentication Socket File Creation
The SSH authentication agent follows symlinks via a UNIX domain socket.
23RISK
open ↗Exploit-DB✓ VexDay Proof
ProFTPd 1.2 pre6 - 'snprintf' Remote Root
The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5 - RASMAN Privilege Escalation
The security descriptor for RASMAN allows users to point to an alternate location via the Windows NT Service Control Man
28RISK
open ↗Exploit-DB✓ VexDay Proof
Computalynx CMail 2.3 SP2/2.4 - SMTP Buffer Overflow
Computalynx CMail 2.4 and CMail 2.3 SP2 SMTP servers are vulnerable to a buffer overflow attack in the MAIL FROM command
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 5 / Netscape Communicator 4.0/4.5/4.6 - JavaScript STYLE
Hotmail allows Javascript to be executed via the HTML STYLE tag, allowing remote attackers to execute commands on the us
23RISK
open ↗Exploit-DB✓ VexDay Proof
FuseWare FuseMail 2.7 - POP Mail Buffer Overflow
Buffer overflow in FuseMAIL POP service via long USER and PASS commands.
23RISK
open ↗Exploit-DB✓ VexDay Proof
DIGITAL UNIX 4.0 d/f / AIX 4.3.2 / CDE 2.1 / IRIX 6.5.14 / Solaris 7.0 / SunOS 4.1.4 - Local Buffer Overflow
Buffer overflow in TT_SESSION environment variable in ToolTalk shared library allows local users to gain root privileges
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netscape Enterprise Server 3.51/3.6 SP2 - Accept Buffer Overflow
Buffer overflow in Accept command in Netscape Enterprise Server 3.6 with the SSL Handshake Patch.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Common Desktop Environment 2.1 20 / Solaris 7.0 - 'dtspcd' Local Privilege Escalation
The CDE dtspcd daemon allows local users to execute arbitrary commands via a symlink attack.
23RISK
open ↗Exploit-DB✓ VexDay Proof
DIGITAL UNIX 4.0 d/e/f / AIX 4.3.2 / CDE 2.1 / IRIX 6.5.14 / Solaris 7.0 - Local Buffer Overflow
Buffer overflow in the AddSuLog function of the CDE dtaction utility allows local users to gain root privileges via a lo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Solaris 7.0 /usr/bin/mail - '-m' Local Buffer Overflow
Buffer overflow in mail command in Solaris 2.7 and 2.7 allows local users to gain privileges via a long -m argument.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 4.0.1/5 - Import/Export Favorites
Internet Explorer 5.0 and 5.01 allows remote attackers to modify or execute files via the Import/Export Favorites featur
28RISK
open ↗Exploit-DB✓ VexDay Proof
FreeBSD 5.0 / NetBSD 1.4.2 / OpenBSD 2.7 - 'setsockopt()' Denial of Service
FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs u
23RISK
open ↗Exploit-DB✓ VexDay Proof
ISC INN 2.2 / RedHat Linux 6.0 - inews Buffer Overflow
Buffer overflow in INN inews program.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Netscape Communicator 4.06/4.5/4.6/4.51/4.61 - EMBED Buffer Overflow
Buffer overflow in Netscape Communicator via EMBED tags in the pluginspage option.
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.