Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
Oracle E-Business Suite 12.2.3 - 'IESFOOTPRINT' SQL Injection
Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Sup
28RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VirtualBox Guest Additions 5.1.18 - Unprivileged Windows User-Mode Guest Code Double-Free
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Shared Folder). Supported ve
23RISK
open ↗Exploit-DB
LightDM (Ubuntu 16.04/16.10) - 'Guest Account' Local Privilege Escalation
In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrar
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Safari - Array concat Memory Corruption
An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS bef
23RISK
open ↗Exploit-DB
Oracle PeopleSoft - 'PeopleSoftServiceListeningConnector' XML External Entity via DOCTYPE
Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integratio
35RISK
open ↗Exploit-DB✓ VexDay Proof
Realtek Audio Driver 6.0.1.7898 (Windows 10) - Dolby Audio X2 Service Privilege Escalation
The Dolby DAX2 and DAX3 API services are vulnerable to a privilege escalation vulnerability that allows a normal user to
23RISK
open ↗Exploit-DB✓ VexDay Proof
HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion
A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP ve
28RISK
open ↗Exploit-DB✓ VexDay Proof
HPE OpenCall Media Platform (OCMP) 4.3.2 - Cross-Site Scripting / Remote File Inclusion
A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP ve
23RISK
open ↗Exploit-DB
OpenText Documentum Content Server - dm_bp_transition.ebs docbase Method Arbitrary Code Execution
OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote aut
23RISK
open ↗Exploit-DB
SquirrelMail < 1.4.22 - Remote Code Execution
SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a
35RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox - Guest-to-Host Privilege Escalation via Broken Length Handling in slirp Copy
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox - 'virtio-net' Guest-to-Host Out-of-Bounds Write
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 (Build 10586) - 'IEETWCollector' Arbitrary Directory/File Deletion Privilege Escalation
An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - Runtime Broker ClipboardBroker Privilege Escalation
An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows
28RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox - Environment and ioctl Unprivileged Host User to Host Kernel Privilege Escalation
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution
Microsoft .NET Framework 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allows an attacker with access to the local system t
28RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 5.0.32 r112930 (x64) - Windows Process COM Injection Privilege Escalation
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Oracle VM VirtualBox 5.1.14 r112924 - Unprivileged Host User to Host Kernel Privilege Escalation via ALSA config
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗Exploit-DB✓ VexDay Proof
Dmitry 1.3a - Local Buffer Overflow (PoC)
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cau
33RISK
open ↗Exploit-DB
Tenable Appliance < 4.5 - Root Remote Code Execution
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI.
28RISK
open ↗Exploit-DB
Microsoft Word - '.RTF' Remote Code Execution
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - SMB Remote Code Execution Scanner (MS17-010) (Metasploit)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗Exploit-DB✓ VexDay Proof
Mantis Bug Tracker 1.3.0/2.3.0 - Password Reset
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value
60RISK
open ↗Exploit-DB
Mozilla Firefox - Address Bar Spoofing
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leadin
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.