Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
21,497 exploits
Referência
CVE-2021-3156
CVE-2021-3156HIGHunder attack
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
Referência
CVE-2023-28771
CVE-2023-28771CRITICALunder attack
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware vers
100RISK
open ↗
Referência
CVE-2023-23333
CVE-2023-23333CRITICAL
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassin
85RISK
open ↗
Referência
CVE-2021-42237
CVE-2021-42237CRITICALunder attackransomware
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it
100RISK
open ↗
Referência
CVE-2022-36804
CVE-2022-36804HIGHunder attack
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
Referência
CVE-2022-36804
CVE-2022-36804HIGHunder attack
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
Referência
CVE-2023-22515
CVE-2023-22515CRITICALunder attackransomware
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISK
open ↗
Referência
CVE-2018-7602
CVE-2018-7602CRITICALunder attackransomware
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RISK
open ↗
Referência
CVE-2018-7602
CVE-2018-7602CRITICALunder attackransomware
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
100RISK
open ↗
Referência
CVE-2020-10199
CVE-2020-10199HIGHunder attack
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
100RISK
open ↗
Referência
CVE-2020-10199
CVE-2020-10199HIGHunder attack
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
100RISK
open ↗
Referência
CVE-2017-8678
CVE-2017-8678—
The Windows kernel component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server
23RISK
open ↗
Referência
CVE-2019-16278
CVE-2019-16278CRITICALunder attack
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co
100RISK
open ↗
Referência
CVE-2019-16278
CVE-2019-16278CRITICALunder attack
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co
100RISK
open ↗
Referência
CVE-2021-40539
CVE-2021-40539CRITICALunder attackransomware
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta
100RISK
open ↗
Referência
CVE-2019-3929
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Referência
CVE-2019-3929
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Referência
CVE-2019-3929
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Referência
CVE-2019-25676
CVE-2019-25676HIGH
Ask Expert Script 3.0.5 Cross Site Scripting SQL Injection
41RISK
open ↗
Referência
CVE-2017-9791
CVE-2017-9791CRITICALunder attack
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe
100RISK
open ↗
Referência
CVE-2017-9791
CVE-2017-9791CRITICALunder attack
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe
100RISK
open ↗
Referência
CVE-2016-7612
CVE-2016-7612—
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchO
23RISK
open ↗
Referência
CVE-2023-32560
CVE-2023-32560HIGH
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup
78RISK
open ↗
Referência
CVE-2023-32560
CVE-2023-32560HIGH
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disrup
78RISK
open ↗
Referência
CVE-2020-7209
CVE-2020-7209—
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RISK
open ↗
Referência
CVE-2020-7209
CVE-2020-7209—
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
60RISK
open ↗
Referência
CVE-2010-1955
CVE-2010-1955—
Directory traversal vulnerability in the Deluxe Blog Factory (com_blogfactory) component 1.1.2 for Joomla! allows remote
43RISK
open ↗
Referência
CVE-2010-1956
CVE-2010-1956—
Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows
43RISK
open ↗
Referência
CVE-2010-1956
CVE-2010-1956—
Directory traversal vulnerability in the Gadget Factory (com_gadgetfactory) component 1.0.0 and 1.5.0 for Joomla! allows
43RISK
open ↗
Referência
CVE-2010-1957
CVE-2010-1957—
Directory traversal vulnerability in the Love Factory (com_lovefactory) component 1.3.4 for Joomla! allows remote attack
43RISK
open ↗
← previouspage 175 / 717next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.