Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,589cataloged exploits

34,508CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,554GitHub PoC 13,689VulnCheck XDB 8,216Nuclei 4,223Metasploit 3,464✓ verified onlyrecent popular risk

8,216 exploits

VulnCheck XDB

client-side

CVE-2022-30190HIGHunder attackransomware15 Sep 2022

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RISK

VulnCheck XDB

client-side

CVE-2021-42013CRITICALunder attackransomware15 Sep 2022

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISK

VulnCheck XDB

client-side

CVE-2021-42013CRITICALunder attackransomware15 Sep 2022

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISK

VulnCheck XDB

initial-access

CVE-2021-41773HIGHunder attackransomware15 Sep 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

VulnCheck XDB

initial-access

CVE-2021-41773HIGHunder attackransomware15 Sep 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

VulnCheck XDB

initial-access

CVE-2021-41773HIGHunder attackransomware15 Sep 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

VulnCheck XDB

initial-access

CVE-2021-41773HIGHunder attackransomware15 Sep 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

VulnCheck XDB

infoleak

CVE-2021-41773HIGHunder attackransomware15 Sep 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

VulnCheck XDB

infoleak

CVE-2021-41773HIGHunder attackransomware15 Sep 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

VulnCheck XDB

initial-access

CVE-2019-0193HIGHunder attack13 Sep 2022

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,

100RISK

VulnCheck XDB

initial-access

CVE-2022-27925HIGHunder attackransomware12 Sep 2022

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file

100RISK

VulnCheck XDB

remote-with-credentials

CVE-2022-30075—12 Sep 2022

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote

35RISK

VulnCheck XDB

local

CVE-2022-0847HIGHunder attack11 Sep 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

VulnCheck XDB

remote-with-credentials

CVE-2021-38163CRITICALunder attack10 Sep 2022

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated

90RISK

VulnCheck XDB

remote-with-credentials

CVE-2016-5734—10 Sep 2022

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to

60RISK

VulnCheck XDB

initial-access

CVE-2014-6271CRITICALunder attack09 Sep 2022

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

VulnCheck XDB

initial-access

CVE-2017-1000486CRITICALunder attack09 Sep 2022

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

100RISK

VulnCheck XDB

initial-access

CVE-2022-36804HIGHunder attack07 Sep 2022

Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef

100RISK

VulnCheck XDB

local

CVE-2021-34527HIGHunder attackransomware05 Sep 2022

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

VulnCheck XDB

local

CVE-2022-2586MEDIUMunder attack03 Sep 2022

It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-a

68RISK

VulnCheck XDB

initial-access

CVE-2021-3129CRITICALunder attackransomware03 Sep 2022

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISK

VulnCheck XDB

local

CVE-2021-31956HIGHunder attack02 Sep 2022

Windows NTFS Elevation of Privilege Vulnerability

76RISK

VulnCheck XDB

initial-access

CVE-2022-0543CRITICALunder attack01 Sep 2022

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific

100RISK

VulnCheck XDB

local

CVE-2022-0847HIGHunder attack31 Aug 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

VulnCheck XDB

initial-access

CVE-2020-1472MEDIUMunder attackransomware31 Aug 2022

Netlogon Elevation of Privilege Vulnerability

100RISK

VulnCheck XDB

initial-access

CVE-2021-36260CRITICALunder attack29 Aug 2022

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISK

VulnCheck XDB

local

CVE-2022-0492HIGHunder attack27 Aug 2022

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Th

86RISK

VulnCheck XDB

initial-access

CVE-2022-27925HIGHunder attackransomware26 Aug 2022

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file

100RISK

VulnCheck XDB

initial-access

CVE-2022-21907CRITICAL25 Aug 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

VulnCheck XDB

initial-access

CVE-2022-37042CRITICALunder attackransomware25 Aug 2022

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts fi

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.