Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits

36,206CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecent popular risk

19,066 exploits

Exploit-DB✓ VexDay Proof

Apple iOS 11.2.5 / watchOS 4.2.2 / tvOS 11.2.5 - 'bluetoothd' Memory Corruption

CVE-2018-4087—dosmultiple28 Feb 2018

An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. tvOS before 11.2.5 is affected. watchO

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows 8.1/2012 R2 - SMBv3 Null Pointer Dereference Denial of Service

CVE-2018-0833—doswindows27 Feb 2018

The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2

35RISK

Exploit-DB✓ VexDay Proof

Asterisk chan_pjsip 15.2.0 - 'INVITE' Denial of Service

CVE-2018-7286—doslinux27 Feb 2018

An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asteris

35RISK

Exploit-DB✓ VexDay Proof

Asterisk chan_pjsip 15.2.0 - 'SUBSCRIBE' Stack Corruption

CVE-2018-7284—doslinux27 Feb 2018

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Ce

35RISK

Exploit-DB✓ VexDay Proof

AsusWRT LAN - Remote Code Execution (Metasploit)

CVE-2018-6000—remotehardware26 Feb 2018

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpn

60RISK

Exploit-DB✓ VexDay Proof

AsusWRT LAN - Remote Code Execution (Metasploit)

CVE-2018-5999—remotehardware26 Feb 2018

An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, pro

60RISK

Exploit-DB✓ VexDay Proof

CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit)

CVE-2018-6892—remotewindows26 Feb 2018

An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy

60RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6229—webappsjsp22 Feb 2018

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker

28RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6230—webappsjsp22 Feb 2018

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 search configuration script could allow an

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6225—webappsjsp22 Feb 2018

An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenti

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6228—webappsjsp22 Feb 2018

A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to exe

28RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6223—webappsjsp22 Feb 2018

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allo

28RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6222—webappsjsp22 Feb 2018

Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log fi

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6224—webappsjsp22 Feb 2018

A lack of cross-site request forgery (CSRF) protection vulnerability in Trend Micro Email Encryption Gateway 5.5 could a

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6219—webappsjsp22 Feb 2018

An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdr

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6227—webappsjsp22 Feb 2018

A stored cross-site scripting (XSS) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6220—webappsjsp22 Feb 2018

An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbi

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6221—webappsjsp22 Feb 2018

An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle

23RISK

Exploit-DB✓ VexDay Proof

Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities

CVE-2018-6226—webappsjsp22 Feb 2018

Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - NPFS Symlink Security Feature Bypass/Elevation of Privilege/Dangerous Behavior

CVE-2018-0823—localwindows20 Feb 2018

The Named Pipe File System in Windows 10 version 1709 and Windows Server, version 1709 allows an elevation of privilege

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows Kernel - 'nt!RtlpCopyLegacyContextX86' Stack Memory Disclosure

CVE-2018-0832—doswindows20 Feb 2018

The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Window

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Global Reparse Point Security Feature Bypass/Elevation of Privilege

CVE-2018-0822—localwindows20 Feb 2018

NTFS in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an eleva

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - StorSvc SvcMoveFileInheritSecurity Arbitrary File Creation Privilege Escalation

CVE-2018-0826—localwindows20 Feb 2018

Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, versi

23RISK

Exploit-DB✓ VexDay Proof

MagniComp SysInfo - mcsiwrapper Privilege Escalation (Metasploit)

CVE-2017-6516—localmultiple20 Feb 2018

A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow

38RISK

Exploit-DB✓ VexDay Proof

Microsoft Windows - Constrained Impersonation Capability Privilege Escalation

CVE-2018-0821—localwindows20 Feb 2018

AppContainer in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Internet Explorer 11 - 'Js::RegexHelper::RegexReplace' Use-After-Free

CVE-2018-0866—doswindows20 Feb 2018

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se

35RISK

Exploit-DB✓ VexDay Proof

Joomla! Component JB Bus 2.3 - 'order_number' SQL Injection

CVE-2018-6372—webappsphp16 Feb 2018

SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.

23RISK

Exploit-DB✓ VexDay Proof

Joomla! Component jGive 2.0.9 - SQL Injection

CVE-2018-5970—webappsphp16 Feb 2018

SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries paramete

23RISK

Exploit-DB✓ VexDay Proof

Joomla! Component Google Map Landkarten 4.2.3 - SQL Injection

CVE-2018-6396—webappsphp16 Feb 2018

SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a l

28RISK

Exploit-DB✓ VexDay Proof

Joomla! Component JomEstate PRO 3.7 - 'id' SQL Injection

CVE-2018-6368—webappsphp16 Feb 2018

SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed acti

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.