Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
8,460 exploits
VulnCheck XDB
client-side
CVE-2018-20250HIGHunder attackransomware04 Mar 2019
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2018-20250HIGHunder attackransomware28 Feb 2019
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-7238CRITICALunder attack24 Feb 2019
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2018-20250HIGHunder attackransomware23 Feb 2019
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-6340HIGHunder attack23 Feb 2019
Drupal core - Highly critical - Remote Code Execution
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2018-20250HIGHunder attackransomware22 Feb 2019
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
VulnCheck XDB
local
CVE-2019-5736—20 Feb 2019
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2019-1003000—15 Feb 2019
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/
60RISK
open ↗
VulnCheck XDB
local
CVE-2019-5736—14 Feb 2019
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗
VulnCheck XDB
local
CVE-2019-5736—13 Feb 2019
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗
VulnCheck XDB
local
CVE-2019-5736—12 Feb 2019
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-6961HIGHunder attack08 Feb 2019
VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-1653HIGHunder attack30 Jan 2019
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-9995—28 Jan 2019
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2018-18852—26 Jan 2019
Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-in
35RISK
open ↗
VulnCheck XDB
infoleak
CVE-2019-1652HIGHunder attack24 Jan 2019
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2019-1653HIGHunder attack24 Jan 2019
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-8581HIGHunder attackransomware24 Jan 2019
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of
76RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-7494CRITICALunder attackransomware20 Jan 2019
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-8174HIGHunder attackransomware20 Jan 2019
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-10562CRITICALunder attackransomware20 Jan 2019
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_ac
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2018-4878HIGHunder attackransomware20 Jan 2019
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISK
open ↗
VulnCheck XDB
local
CVE-2018-8453HIGHunder attackransomware18 Jan 2019
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
100RISK
open ↗
VulnCheck XDB
local
CVE-2018-8453HIGHunder attackransomware18 Jan 2019
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-12617HIGHunder attack14 Jan 2019
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-2628CRITICALunder attack07 Jan 2019
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2018-8581HIGHunder attackransomware28 Dec 2018
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of
76RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-8581HIGHunder attackransomware27 Dec 2018
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of
76RISK
open ↗
VulnCheck XDB
client-side
CVE-2017-10271HIGHunder attackransomware20 Dec 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2015-9251—20 Dec 2018
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed wi
28RISK
open ↗
← previouspage 266 / 282next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.