Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,057cataloged exploits
36,288CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
Adobe Flash - Type Confusion in IExternalizable.readExternal When Performing Local Serialization
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux all
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office / COM Object - DLL Planting with 'comsvcs.dll' Delay Load of 'mqrt.dll' (MS15-132)
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office / COM Object - 'els.dll' DLL Planting (MS15-134)
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allo
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Media Center - '.Link' File Incorrectly Resolved Reference (MS15-134)
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers t
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 misha
98RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges v
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allo
60RISK
open ↗Exploit-DB✓ VexDay Proof
Atlassian HipChat for Jira Plugin - Velocity Template Injection (Metasploit)
The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java
50RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Office - OLE Multiple DLL Side Loading Vulnerabilities (MS15-132/MS16-014/MS16-025/MS16-041/MS16-070) (Metasploit)
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2
60RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle BeeHive 2 - 'voice-servlet processEvaluation()' Write File (Metasploit)
Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2
60RISK
open ↗Exploit-DB✓ VexDay Proof
Man-db 2.6.7.1 - Local Privilege Escalation
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB✓ VexDay Proof
Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)
20RISK
open ↗Exploit-DB✓ VexDay Proof
abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm
86RISK
open ↗Exploit-DB✓ VexDay Proof
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm
86RISK
open ↗Exploit-DB✓ VexDay Proof
abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows
23RISK
open ↗Exploit-DB✓ VexDay Proof
SAP Sybase Adaptive Server Enterprise - XML External Entity Information Disclosure
The XMLParse procedure in SAP Sybase Adaptive Server Enterprise (ASE) 15.7 ESD 2 allows remote authenticated users to re
23RISK
open ↗Exploit-DB✓ VexDay Proof
Nvidia Stereoscopic 3D Driver Service 7.17.13.5382 - Arbitrary Run Key Creation
nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Race Condition DestroySMWP Use-After-Free (MS15-115)
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'ndis.sys' IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117)
Buffer overflow in the Network Driver Interface Standard (NDIS) implementation in Microsoft Windows Vista SP2, Windows S
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Cursor Object Memory Leak (MS15-115)
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! 3.4.4 Component Content History - SQL Injection / Remote Code Execution (Metasploit)
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! 3.4.4 Component Content History - SQL Injection / Remote Code Execution (Metasploit)
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p
60RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! 3.4.4 Component Content History - SQL Injection / Remote Code Execution (Metasploit)
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un
60RISK
open ↗Exploit-DB✓ VexDay Proof
vBulletin 5.x - Remote Code Execution
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PH
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - Device Contexts and NtGdiSelectBitmap Use-After-Free (MS15-115)
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Chkrootkit - Local Privilege Escalation (Metasploit)
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute a
38RISK
open ↗Exploit-DB✓ VexDay Proof
Google Chrome - open-vcdiff Out-of-Bounds Read in Browser Process Integer Overflow
Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a denial of service o
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.