Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,020cataloged exploits

35,276CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecent popular risk

14,080 exploits

GitHub PoC★ 14

jiansiting/weblogic-cve-2018-2628

CVE-2018-2628CRITICALunder attack18 Apr 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

100RISK

open ↗

GitHub PoC★ 2

zjxzjx/CVE-2018-2628-detect

CVE-2018-2628CRITICALunder attack18 Apr 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

100RISK

open ↗

GitHub PoC★ 15

WebLogic WLS核心组件反序列化漏洞多线程批量检测脚本 CVE-2018-2628-MultiThreading

CVE-2018-2628CRITICALunder attack18 Apr 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

100RISK

open ↗

GitHub PoC★ 20

CVE-2018-2628

CVE-2018-2628CRITICALunder attack18 Apr 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

100RISK

open ↗

GitHub PoC★ 78

CVE-2018-2628 & CVE-2018-2893

CVE-2018-2628CRITICALunder attack18 Apr 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

100RISK

open ↗

GitHub PoC★ 141

Exploit for Drupal 7 <= 7.57 CVE-2018-7600

CVE-2018-7600CRITICALunder attackransomware17 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 24

POC for CVE-2018-1273

CVE-2018-1273CRITICALunder attackransomware17 Apr 2018

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property

100RISK

open ↗

GitHub PoC★ 1

This is a Java program that exploits Spring Break vulnerability (CVE-2017-8046).

CVE-2017-8046—16 Apr 2018

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions pri

60RISK

open ↗

GitHub PoC★ 71

CVE-2018-7600 - Drupal 7.x RCE

CVE-2018-7600CRITICALunder attackransomware16 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 4

Testing and exploitation tool for Drupalgeddon 2 (CVE-2018-7600)

CVE-2018-7600CRITICALunder attackransomware15 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 7

Proof-of-Concept for Drupal CVE-2018-7600 / SA-CORE-2018-002

CVE-2018-7600CRITICALunder attackransomware15 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 3

Tool to check for CVE-2018-7600 vulnerability on several URLS

CVE-2018-7600CRITICALunder attackransomware15 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 41

CVE-2018-6546-Exploit

CVE-2018-6546—15 Apr 2018

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming

28RISK

open ↗

GitHub PoC★ 4

PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 (Drupalgeddon 2).

CVE-2018-7600CRITICALunder attackransomware14 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 5

MSF exploit module for Drupalgeddon 2 (CVE-2018-7600 / SA-CORE-2018-002)

CVE-2018-7600CRITICALunder attackransomware14 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 7

Drupal 0day Remote PHP Code Execution (Perl)

CVE-2018-7600CRITICALunder attackransomware14 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 10

Environment for CVE-2018-1273 (Spring Data Commons)

CVE-2018-1273CRITICALunder attackransomware13 Apr 2018

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property

100RISK

open ↗

GitHub PoC★ 3

CVE-2018-7600 (Drupal)

CVE-2018-7600CRITICALunder attackransomware13 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 600

Exploit for Drupal v7.x + v8.x (Drupalgeddon 2 / CVE-2018-7600 / SA-CORE-2018-002)

CVE-2018-7600CRITICALunder attackransomware12 Apr 2018

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC

Example exploit for CVE-2016-5195

CVE-2016-5195HIGHunder attack11 Apr 2018

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

open ↗

GitHub PoC★ 14

Fixed No Virus Manual Automatic Loader exe no zip because zip picks up the anti virus detector.

CVE-2017-0213HIGHunder attackransomware10 Apr 2018

Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Ser

93RISK

open ↗

GitHub PoC★ 5

CVE-2017-8570生成脚本(CVE-2017-0199另一种利用方式)

CVE-2017-8570HIGHunder attack08 Apr 2018

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic

93RISK

open ↗

GitHub PoC★ 2

Android Blueborne RCE CVE-2017-0781

CVE-2017-0781—06 Apr 2018

A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1

28RISK

open ↗

GitHub PoC★ 2

Android Blueborne RCE CVE-2017-0781

CVE-2017-0781—06 Apr 2018

A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1

28RISK

open ↗

GitHub PoC★ 7

Flash Exploit Poc

CVE-2018-4878HIGHunder attackransomware04 Apr 2018

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to

93RISK

open ↗

GitHub PoC

Xerver 2.10 - Multiple Request Denial of Service Vulnerabilities

CVE-2002-0448—03 Apr 2018

Xerver Free Web Server 2.10 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request

28RISK

open ↗

GitHub PoC

March Networks DVR 3204 - Logfile Information Disclosure

CVE-2007-6638—03 Apr 2018

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows r

28RISK

open ↗

GitHub PoC

Airsensor M520 - HTTPd Unauthenticated Remote Denial of Service / Buffer Overflow (PoC)

CVE-2007-5036—03 Apr 2018

Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 and 4.4.1.4 allow remote authenticated

23RISK

open ↗

GitHub PoC

Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request, possibly triggering a buffer overflow.

CVE-2002-0201—03 Apr 2018

Cyberstop Web Server for Windows 0.1 allows remote attackers to cause a denial of service (crash) and possibly execute a

28RISK

open ↗

GitHub PoC

Nortel Wireless LAN Access Point 2200 Series - Denial of Service

CVE-2004-2549—03 Apr 2018

Nortel Wireless LAN (WLAN) Access Point (AP) 2220, 2221, and 2225 allow remote attackers to cause a denial of service (s

28RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.