Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,647cataloged exploits

34,986CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 14,014VulnCheck XDB 8,571Nuclei 4,248Metasploit 3,472✓ verified onlyrecent popular risk

14,014 exploits

GitHub PoC★ 12

CVE-2018-15982_EXP_IE

CVE-2018-15982HIGHunder attackransomware12 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

open ↗

GitHub PoC★ 29

Aggressor Script to launch IE driveby for CVE-2018-15982.

CVE-2018-15982HIGHunder attackransomware12 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

open ↗

GitHub PoC★ 11

Script and metasploit module for CVE-2018-15982

CVE-2018-15982HIGHunder attackransomware11 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

open ↗

GitHub PoC

Just My ports of CVE-2017-8759

CVE-2017-8759HIGHunder attack11 Dec 2018

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely vi

93RISK

open ↗

GitHub PoC★ 1

securifera/CVE-2018-16156-Exploit

CVE-2018-16156—11 Dec 2018

In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes u

23RISK

open ↗

GitHub PoC★ 1

CVE-2014-0160

CVE-2014-0160HIGHunder attack10 Dec 2018

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

open ↗

GitHub PoC

Microsoft Equation 3.0/Convert python2 to python3

CVE-2017-11882HIGHunder attackransomware10 Dec 2018

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

open ↗

GitHub PoC★ 179

exp of CVE-2018-15982

CVE-2018-15982HIGHunder attackransomware10 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

open ↗

GitHub PoC★ 4

个人整理的Centos7.x + Kubernetes-1.12.3 + Dashboard-1.8.3 无 CVE-2018-1002105 漏洞的master节点全自动快速一键安装部署文件，适用于测试环境，生产环境的快速安装部署

CVE-2018-1002105CRITICAL10 Dec 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

open ↗

GitHub PoC★ 2

Proof of consept for CVE-2018-17431

CVE-2018-17431—08 Dec 2018

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication

60RISK

open ↗

GitHub PoC★ 9

Unrestricted file upload in Adobe ColdFusion

CVE-2018-15961CRITICALunder attack06 Dec 2018

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr

100RISK

open ↗

GitHub PoC★ 13

CVE-2018-15982_PoC

CVE-2018-15982HIGHunder attackransomware06 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

open ↗

GitHub PoC★ 222

PoC for CVE-2018-1002105.

CVE-2018-1002105CRITICAL06 Dec 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

open ↗

GitHub PoC★ 191

Test utility for cve-2018-1002105

CVE-2018-1002105CRITICAL05 Dec 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

open ↗

GitHub PoC

uzzzval/cve-2004-2167

CVE-2004-2167—05 Dec 2018

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary

28RISK

open ↗

GitHub PoC

Flash sources for CVE-2018-15982 used by NK

CVE-2018-15982HIGHunder attackransomware05 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

open ↗

GitHub PoC★ 4

dnsmasq rop exploit with NX bypass

CVE-2017-14493—04 Dec 2018

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu

45RISK

open ↗

GitHub PoC

CVE-2014-8682

CVE-2014-8682—04 Dec 2018

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow r

50RISK

open ↗

GitHub PoC★ 1

A collection of code pertaining to CVE-2016-0728 (various authors)

CVE-2016-0728—03 Dec 2018

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref

23RISK

open ↗

GitHub PoC

A VENOM (CVE-2015-3456) Exploit / PoC written in C.

CVE-2015-3456—03 Dec 2018

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a

28RISK

open ↗

GitHub PoC

This is an exploitation guide for CVE-2016-2233

CVE-2016-2233—03 Dec 2018

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve

35RISK

open ↗

GitHub PoC

CVE-2014-4511

CVE-2014-4511—03 Dec 2018

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in

60RISK

open ↗

GitHub PoC★ 104

CVE-2018-8021 Proof-Of-Concept and Exploit

CVE-2018-8021—02 Dec 2018

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos

35RISK

open ↗

GitHub PoC

CVE-2016-1240 exploit and patch

CVE-2016-1240—02 Dec 2018

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

38RISK

open ↗

GitHub PoC★ 39

PrestaShop (1.6.x <= 1.6.1.23 or 1.7.x <= 1.7.4.4) Back Office Remote Code Execution (CVE-2018-19126)

CVE-2018-19126—01 Dec 2018

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file u

28RISK

open ↗

GitHub PoC★ 50

All about CVE-2018-14667; From what it is to how to successfully exploit it.

CVE-2018-14667CRITICALunder attack30 Nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISK

open ↗

GitHub PoC

lol-fi/cve-2011-4862

CVE-2011-4862—28 Nov 2018

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka k

60RISK

open ↗

GitHub PoC★ 1

about CVE-2018-14667 from RichFaces Framework 3.3.4

CVE-2018-14667CRITICALunder attack28 Nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISK

open ↗

GitHub PoC★ 1

The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10

CVE-2018-7691MEDIUM26 Nov 2018

MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access

33RISK

open ↗

GitHub PoC★ 1

The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10

CVE-2018-7690MEDIUM26 Nov 2018

MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.