Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,496cataloged exploits

34,964CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 13,937VulnCheck XDB 8,510Nuclei 4,239Metasploit 3,468✓ verified onlyrecent popular risk

13,937 exploits

GitHub PoC★ 7

Strapi Framework Vulnerable to Remote Code Execution

CVE-2019-19609—29 Aug 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

open ↗

GitHub PoC★ 1

Citrix ADC RCE cve-2019-19781

CVE-2019-19781CRITICALunder attackransomware29 Aug 2021

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

open ↗

GitHub PoC

BabyTeam1024/CVE-2017-3248

CVE-2017-3248—29 Aug 2021

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Suppo

60RISK

open ↗

GitHub PoC★ 11

CVE-2020-25223

CVE-2020-25223CRITICALunder attack29 Aug 2021

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511

100RISK

open ↗

GitHub PoC★ 1

CVE-2004-2687 DistCC Daemon Command Execution

CVE-2004-2687—28 Aug 2021

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at

60RISK

open ↗

GitHub PoC

AssassinUKG/CVE-2021-29447

CVE-2021-29447HIGH27 Aug 2021

WordPress Authenticated XXE attack when installation is running PHP 8

63RISK

open ↗

GitHub PoC★ 1

A proof of concept for CVE-2016-6515

CVE-2016-6515—26 Aug 2021

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a

35RISK

open ↗

GitHub PoC★ 1

Kibana Prototype Pollution

CVE-2019-7609CRITICALunder attack24 Aug 2021

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker

100RISK

open ↗

GitHub PoC★ 24

my exp for chrome V8 CVE-2021-30551

CVE-2021-30551HIGHunder attack22 Aug 2021

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corru

83RISK

open ↗

GitHub PoC

rood8008/CVE-2021-35464

CVE-2021-35464CRITICALunder attackransomware21 Aug 2021

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa

100RISK

open ↗

GitHub PoC★ 1

An implementation of CVE-2015-3306

CVE-2015-3306—21 Aug 2021

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

60RISK

open ↗

GitHub PoC★ 11

CVE-2018-19320 LPE Exploit

CVE-2018-19320HIGHunder attackransomware19 Aug 2021

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING

71RISK

open ↗

GitHub PoC★ 1

CVE-2019-11932

CVE-2019-11932—17 Aug 2021

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version

35RISK

open ↗

GitHub PoC★ 1

A tool to crash MySQL servers with CVE-2017-3599

CVE-2017-3599—16 Aug 2021

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions t

45RISK

open ↗

GitHub PoC★ 30

CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-34473CRITICALunder attackransomware16 Aug 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 1

Multiple Stored XSS Online Doctor Appointment System

CVE-2021-25791—16 Aug 2021

Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment S

23RISK

open ↗

GitHub PoC

The Heartbleed bug `CVE-2014-0160` is a severe implementation flaw in the OpenSSL library, which enables attackers to steal data from the memory of the victim server. The contents of the stolen data depend on what is there in the memory of the server. It could potentially contain private keys, TLS session keys, usernames, passwords, credit cards, etc. The vulnerability is in the implementation of the Heartbeat protocol, which is used by SSL/TLS to keep the connection alive.

CVE-2014-0160HIGHunder attack15 Aug 2021

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

open ↗

GitHub PoC★ 1

tools for automate configure Ubuntu 20.04 enviroment for testing CVE-2021-28476.

CVE-2021-28476CRITICAL15 Aug 2021

Windows Hyper-V Remote Code Execution Vulnerability

60RISK

open ↗

GitHub PoC★ 3

WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5

CVE-2021-24145—14 Aug 2021

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

60RISK

open ↗

GitHub PoC★ 1

An implementation of CVE-2020-1938

CVE-2020-1938CRITICALunder attack14 Aug 2021

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISK

open ↗

GitHub PoC★ 1

Sudo Heap Overflow Baron Samedit

CVE-2021-3156HIGHunder attack13 Aug 2021

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC

WpDiscuz 7.0.4 Arbitrary File Upload Exploit

CVE-2020-24186CRITICAL13 Aug 2021

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

GitHub PoC★ 3

Exploit for CVE-2021-36934

CVE-2021-36934HIGHunder attack12 Aug 2021

Windows Elevation of Privilege Vulnerability

98RISK

open ↗

GitHub PoC

Zeek Package to detect cve-2017-2741

CVE-2017-2741—11 Aug 2021

A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmwa

60RISK

open ↗

GitHub PoC

Jerry-zhuang/CVE-2017-1000117

CVE-2017-1000117—11 Aug 2021

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

60RISK

open ↗

GitHub PoC★ 5

Scanner for CVE-2021-34473, ProxyShell, A Microsoft Exchange On-premise Vulnerability

CVE-2021-34473CRITICALunder attackransomware11 Aug 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 2

CVE-2019-11043

CVE-2019-11043HIGHunder attackransomware10 Aug 2021

Underflow in PHP-FPM can lead to RCE

100RISK

open ↗

GitHub PoC★ 46

nuclei scanner for proxyshell ( CVE-2021-34473 )

CVE-2021-34473CRITICALunder attackransomware10 Aug 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 10

Windows Font Driver Type 1 VToHOrigin stack corruption

CVE-2020-1020HIGHunder attack10 Aug 2021

A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly

83RISK

open ↗

GitHub PoC

ZeroShell命令执行漏洞批量扫描poc+exp

CVE-2019-12725—10 Aug 2021

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web ap

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.