Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,057cataloged exploits
36,288CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecentpopularrisk
3,489 exploits
Metasploit600
Wordpress Plainview Activity Monitor RCE
CVE-2018-15877—26 Aug 2018
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISK
open ↗
Metasploit600
Apache Struts 2 Namespace Redirect OGNL Injection
CVE-2018-11776HIGHunder attack22 Aug 2018
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗
Metasploit600
Ghostscript Failed Restore Command Execution
CVE-2018-16509—21 Aug 2018
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handlin
60RISK
open ↗
Metasploit300
Pimcore Gather Credentials via SQL Injection
CVE-2018-14058—13 Aug 2018
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
43RISK
open ↗
Metasploit600
PHP Laravel Framework token Unserialize Remote Command Execution
CVE-2018-15133HIGHunder attack07 Aug 2018
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISK
open ↗
Metasploit600
PHP Laravel Framework token Unserialize Remote Command Execution
CVE-2017-16894—07 Aug 2018
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwo
60RISK
open ↗
Metasploit300
Windows unmarshal post exploitation
CVE-2018-0824HIGHunder attack05 Aug 2018
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized
100RISK
open ↗
Metasploit600
NUUO NVRmini upgrade_handle.php Remote Command Execution
CVE-2018-14933CRITICALunder attack04 Aug 2018
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par
100RISK
open ↗
Metasploit300
cgit Directory Traversal
CVE-2018-14912—03 Aug 2018
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned
60RISK
open ↗
Metasploit300
Mikrotik Winbox Arbitrary File Read
CVE-2018-14847CRITICALunder attack02 Aug 2018
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗
Metasploit600
Network Manager VPNC Username Privilege Escalation
CVE-2018-10900HIGH26 Jul 2018
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attac
56RISK
open ↗
Metasploit300
Eaton Xpert Meter SSH Private Key Exposure Scanner
CVE-2018-16158—18 Jul 2018
Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different cus
30RISK
open ↗
Metasploit300
Dicoogle PACS Web Server Directory Traversal
CVE-2018-25113HIGH11 Jul 2018
Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal
36RISK
open ↗
Metasploit600
QNAP Q'Center change_passwd Command Execution
CVE-2018-0707—11 Jul 2018
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RISK
open ↗
Metasploit600
QNAP Q'Center change_passwd Command Execution
CVE-2018-0706—11 Jul 2018
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RISK
open ↗
Metasploit600
CMS Made Simple Authenticated RCE via File Upload/Copy
CVE-2018-1000094—03 Jul 2018
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows a
50RISK
open ↗
Metasploit300
Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow
CVE-2018-10594—02 Jul 2018
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPS
50RISK
open ↗
Metasploit300
Wordpress Arbitrary File Deletion
CVE-2018-12895—26 Jun 2018
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/
30RISK
open ↗
Metasploit600
PRTG Network Monitor Authenticated RCE
CVE-2018-9276HIGHunder attack25 Jun 2018
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra
100RISK
open ↗
Metasploit400
phpMyAdmin Authenticated Remote Code Execution
CVE-2018-12613—19 Jun 2018
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
60RISK
open ↗
Metasploit600
MicroFocus Secure Messaging Gateway Remote Code Execution
CVE-2018-12464CRITICAL19 Jun 2018
Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway
85RISK
open ↗
Metasploit600
MicroFocus Secure Messaging Gateway Remote Code Execution
CVE-2018-12465CRITICAL19 Jun 2018
Remote Code Execution in Micro Focus Secure Messaging Gateway
85RISK
open ↗
Metasploit600
Axis Network Camera .srv-to-parhand RCE
CVE-2018-10662—18 Jun 2018
An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface.
60RISK
open ↗
Metasploit600
Axis Network Camera .srv-to-parhand RCE
CVE-2018-10661—18 Jun 2018
An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control.
60RISK
open ↗
Metasploit600
Axis Network Camera .srv-to-parhand RCE
CVE-2018-10660—18 Jun 2018
An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.
60RISK
open ↗
Metasploit300
Splunk __raw Server Info Disclosure
CVE-2018-11409—08 Jun 2018
Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json
60RISK
open ↗
Metasploit300
Cisco ASA Directory Traversal
CVE-2018-0296HIGHunder attack06 Jun 2018
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remo
100RISK
open ↗
Metasploit300
WebKitGTK+ WebKitFaviconDatabase DoS
CVE-2018-11646—03 Jun 2018
webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon
50RISK
open ↗
Metasploit600
Quest KACE Systems Management Command Injection
CVE-2018-11138CRITICALunder attackransomware31 May 2018
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
100RISK
open ↗
Metasploit300
Dolibarr Gather Credentials via SQL Injection
CVE-2018-10094—30 May 2018
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto
60RISK
open ↗
← previouspage 37 / 117next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.