Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
19,066 exploits
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Stack-to-Heap Copy (Incomplete Fix) (2)
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution,
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Stack-to-Heap Copy (Incomplete Fix) (1)
ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution,
35RISK
open ↗Exploit-DB✓ VexDay Proof
Google Chrome V8 - 'ElementsAccessorBase::CollectValuesOrEntriesImpl' Type Confusion
Type Confusion in the implementation of __defineGetter__ in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
WampServer 3.1.2 - Cross-Site Request Forgery
Wampserver before 3.1.3 has CSRF in add_vhost.php.
23RISK
open ↗Exploit-DB✓ VexDay Proof
WampServer 3.1.1 - Cross-Site Scripting / Cross-Site Request Forgery
Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or H
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component AcySMS 3.5.0 - CSV Macro Injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extensio
23RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing exte
23RISK
open ↗Exploit-DB✓ VexDay Proof
GitStack - Unsanitized Argument Remote Code Execution (Metasploit)
An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unau
60RISK
open ↗Exploit-DB✓ VexDay Proof
Joomla! Component Fields - SQLi Remote Code Execution (Metasploit)
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISK
open ↗Exploit-DB✓ VexDay Proof
Exodus Wallet (ElectronJS Framework) - Remote Code Execution (Metasploit)
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Remote Assistance - XML External Entity Injection
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Window
33RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Site Editor 1.1.1 - Local File Inclusion
A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to re
50RISK
open ↗Exploit-DB✓ VexDay Proof
Dell EMC NetWorker - Denial of Service
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the '
28RISK
open ↗Exploit-DB✓ VexDay Proof
Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalation
Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Desktop Bridge VFS Privilege Escalation
The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server,
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - 'NtQueryVirtualMemory(MemoryMappedFilenameInformation)' 64-bit Pool Memory Disclosure
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Desktop Bridge Virtual Registry Arbitrary File Read/Write Privilege Escalation
The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el
23RISK
open ↗Exploit-DB✓ VexDay Proof
Internet Explorer - 'RegExp.lastMatch' Memory Disclosure
ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - Desktop Bridge Virtual Registry NtLoadKey Arbitrary File Read/Write Privilege Escalation
The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an el
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - 'NtQueryInformationThread(ThreadBasicInformation)' 64-bit Stack Memory Disclosure
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - 'nt!NtWaitForDebugEvent' 64-bit Stack Memory Disclosure
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Kernel - 'nt!KiDispatchException' 64-bit Stack Memory Disclosure
The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Serve
23RISK
open ↗Exploit-DB✓ VexDay Proof
Firefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RISK
open ↗Exploit-DB✓ VexDay Proof
Firefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
35RISK
open ↗Exploit-DB✓ VexDay Proof
Firefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RISK
open ↗Exploit-DB✓ VexDay Proof
Firefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution
Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to ex
28RISK
open ↗Exploit-DB✓ VexDay Proof
Tuleap 9.17.99.189 - Blind SQL Injection
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 a
23RISK
open ↗Exploit-DB✓ VexDay Proof
Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution
A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within th
35RISK
open ↗Exploit-DB✓ VexDay Proof
uWSGI < 2.0.17 - Directory Traversal
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversa
50RISK
open ↗Exploit-DB✓ VexDay Proof
Routers2 2.24 - Cross-Site Scripting
A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.