Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
24,696 exploits
Exploit-DB✓ VexDay Proof
Microsoft FrontPage Personal Web Server 1.0/4.0 - Directory Traversal
Microsoft Personal Web Server and FrontPage Personal Web Server in some Windows systems allows a remote attacker to read
28RISK
open ↗Exploit-DB✓ VexDay Proof
Resolv+ 'RESOLV_HOST_CONF' - Linux Library Command Execution
glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variabl
23RISK
open ↗Exploit-DB✓ VexDay Proof
John S.2 Roberts AnyForm 1.0/2.0 - CGI Semicolon
AnyForm CGI remote execution.
53RISK
open ↗Exploit-DB✓ VexDay Proof
IRIX 5.2/6.0 - Permissions File Manipulation
SGI Desktop Permissions Tool in IRIX 6.0.1 and earlier allows local users to modify permissions for arbitrary files and
23RISK
open ↗Exploit-DB✓ VexDay Proof
NCSA HTTPd 1.x - Remote Buffer Overflow (2)
Buffer overflow in NCSA HTTP daemon v1.3 allows remote command execution.
28RISK
open ↗Exploit-DB✓ VexDay Proof
NCSA HTTPd 1.x - Remote Buffer Overflow (2)
Buffer overflow in NCSA WebServer (1.4.1 and below) gives remote access.
23RISK
open ↗Exploit-DB✓ VexDay Proof
SGI IRIX 6.0.1 - 'colorview' Read Files
colorview in Silicon Graphics IRIX 5.1, 5.2, and 6.0 allows local attackers to read arbitrary files via the -text argume
23RISK
open ↗Exploit-DB✓ VexDay Proof
Majordomo 1.89/1.90 - 'lists' Command Execution
Remote attacker can execute commands through Majordomo using the Reply-To field and a "lists" command.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Sendmail 8.6.9 IDENT - Remote Command Execution
Sendmail 8.6.9 allows remote attackers to execute root commands, using ident.
23RISK
open ↗Exploit-DB✓ VexDay Proof
HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - 'rpc.ypupdated' Command Execution (2)
rpc.ypupdated (NIS) allows remote users to execute arbitrary commands.
28RISK
open ↗Exploit-DB✓ VexDay Proof
HP-UX 10/11/ IRIX 3/4/5/6 / OpenSolaris build snv / Solaris 8/9/10 / SunOS 4.1 - 'rpc.ypupdated' Command Execution (1)
rpc.ypupdated (NIS) allows remote users to execute arbitrary commands.
28RISK
open ↗Exploit-DB✓ VexDay Proof
SGI IRIX 5.2/5.3 - 'serial_ports' Local Privilege Escalation
serial_ports administrative program in IRIX 4.x and 5.x trusts the user's PATH environmental variable to find and execut
23RISK
open ↗Exploit-DB✓ VexDay Proof
SunOS 4.1.4 - arp(8c) Memory Dump
Solaris arp allows local users to read files via the -f parameter, which lists lines in the file that do not parse prope
23RISK
open ↗Exploit-DB✓ VexDay Proof
Digital Ultrix 4.0/4.1 - '/usr/bin/chroot' Local Privilege Escalation
chroot in Digital Ultrix 4.1 and 4.0 is insecurely installed, which allows local users to gain privileges.
23RISK
open ↗Exploit-DB✓ VexDay Proof
SunView (SunOS 4.1.1) - 'selection_svc' Remote File Read
The SunView (SunTools) selection_svc facility allows remote users to read files.
50RISK
open ↗Exploit-DB✓ VexDay Proof
Intel Corporation Express 8100 ISDN Router - Fragmented ICMP
The Intel express 8100 ISDN router allows remote attackers to cause a denial of service via oversized or fragmented ICMP
23RISK
open ↗Exploit-DB✓ VexDay Proof
Berkeley Sendmail 5.58 - Debug
The debug command in Sendmail is enabled, allowing attackers to execute commands as root.
28RISK
open ↗Referência✓ VexDay Proof
Discuz! 6.x/7.x - Remote Code Execution
wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via
23RISK
open ↗Referência✓ VexDay Proof
Pakupaku CMS 0.4 - Arbitrary File Upload / Local File Inclusion
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and ex
23RISK
open ↗Referência✓ VexDay Proof
Censura 1.15.04 - 'censura.php?vendorid' SQL Injection
SQL injection vulnerability in includes/funcs_vendors.php in Censura 1.15.04, and other versions before 1.16.04, allows
23RISK
open ↗Referência✓ VexDay Proof
Beacon 0.2.0 - 'splash.lang.php' Remote File Inclusion
PHP remote file inclusion vulnerability in language/1/splash.lang.php in Beacon 0.2.0 allows remote attackers to execute
23RISK
open ↗Referência✓ VexDay Proof
LushiWarPlaner 1.0 - 'register.php' SQL Injection
SQL injection vulnerability in register.php in LushiWarPlaner 1.0 allows remote attackers to inject arbitrary SQL comman
23RISK
open ↗Referência✓ VexDay Proof
mxBB Module ErrorDocs 1.0 - 'common.php' Remote File Inclusion
PHP remote file inclusion vulnerability in includes/common.php in the ErrorDocs 1.0.0 and earlier module for mxBB (mx_er
23RISK
open ↗Referência✓ VexDay Proof
falcon CMS 1.4.3 - Remote File Inclusion / Cross-Site Scripting
Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbi
23RISK
open ↗Referência✓ VexDay Proof
Basic-CMS - SQL Injection
SQL injection vulnerability in pages/index.php in BASIC-CMS allows remote attackers to execute arbitrary SQL commands vi
43RISK
open ↗Referência✓ VexDay Proof
Comparison Engine Power 1.0 - Blind SQL Injection
SQL injection vulnerability in product.detail.php in Kalptaru Infotech Comparison Engine Power Script 1.0 allows remote
23RISK
open ↗Referência✓ VexDay Proof
X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include an
23RISK
open ↗Referência✓ VexDay Proof
Advaced-Clan-Script 3.4 - 'mcf.php' Remote File Inclusion
PHP remote file inclusion vulnerability in mcf.php in Advanced-Clan-Script (AVCX) 3.4 and earlier allows remote attacker
23RISK
open ↗Referência✓ VexDay Proof
nweb2fax 0.2.7 - Multiple Vulnerabilities
viewrq.php in nweb2fax 0.2.7 and earlier allows remote attackers to execute arbitrary code via shell metacharacters in t
23RISK
open ↗Referência✓ VexDay Proof
PHPStore PHP Job Search Script - Arbitrary File Upload
Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to exec
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.