Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,963cataloged exploits
35,266CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 22,166GitHub PoC 14,059VulnCheck XDB 8,571Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
14,014 exploits
GitHub PoC★ 2
Simple poc of CVE-2018-8353 Microsoft Scripting Engine Use After Free
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
35RISK
open ↗GitHub PoC
jezzus/CVE-2018-11776-Python-PoC
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC
likekabin/CVE-2018-8174-msf
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RISK
open ↗GitHub PoC
jezzus/CVE-2018-4121
An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud b
28RISK
open ↗GitHub PoC★ 2
Apache Struts version analyzer (Ansible) based on CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗GitHub PoC★ 5
A remote code execution exploit for WebLogic based on CVE-2018-2628
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
open ↗GitHub PoC★ 95
Primefaces <= 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exploit
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISK
open ↗GitHub PoC★ 25
CVE-2017-10366: Oracle PeopleSoft 8.54, 8.55, 8.56 Java deserialization exploit
Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Perform
35RISK
open ↗GitHub PoC★ 13
Mitigate CVE-2018-6389 WordPress load-scripts / load-styles attacks
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the
45RISK
open ↗GitHub PoC★ 56
This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers.
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 16
A simple exploit for Apache Struts RCE S2-057 (CVE-2018-11776)
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 3
tuxotron/cve-2018-11776-docker
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 2
Tiny script to enumerate users using CVE-2017-9554 (forget_passwd.cgi)
An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allo
60RISK
open ↗GitHub PoC★ 21
Proof of Concept for CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 303
An exploit for Apache Struts CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 3
moayadalmalat/CVE-2017-12636
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RISK
open ↗GitHub PoC★ 4
Environment for CVE-2018-11776 / S2-057 (Apache Struts 2)
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 12
Vulnerable docker container for CVE-2018-11776
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 10
CVE-2018-11776(S2-057) EXPLOIT CODE
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 123
Working Python test and PoC for CVE-2018-11776, includes Docker lab
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 21
Simple poc of CVE-2018-8414 Windows Package Setting RCE Vulnerability
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows
93RISK
open ↗GitHub PoC★ 15
Creating a vulnerable environment and the PoC
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 111
PoC for Privilege Escalation in Windows 10 Diagnostics Hub Standard Collector Service
An Elevation of Privilege vulnerability exists when Diagnostics Hub Standard Collector allows file creation in arbitrary
23RISK
open ↗GitHub PoC★ 534
Exploit written in Python for CVE-2018-15473 with threading and export formats
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗GitHub PoC★ 3
dangokyo/CVE-2015-5119
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.
100RISK
open ↗GitHub PoC
a exp for cve-2018-9948/9958 , current shellcode called win-calc
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader
50RISK
open ↗GitHub PoC★ 3
CVE-2018-15473 - Opensshenum is an user enumerator exploiting an OpenSsh bug
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗GitHub PoC★ 159
OpenSSH 2.3 up to 7.4 Mass Username Enumeration (CVE-2018-15473).
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗GitHub PoC★ 1
CVE-2018-8120 Windows LPE exploit
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
100RISK
open ↗GitHub PoC★ 258
PoC for CVE-2018-15133 (Laravel unserialize vulnerability)
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.