Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,057cataloged exploits
36,288CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecentpopularrisk
24,695 exploits
Exploit-DB✓ VexDay Proof
Sophos Web Appliance 4.2.1.3 - block/unblock Remote Command Injection (Metasploit)
The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its w
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 9 - MSHTML CDispNode::InsertSiblingNode Use-After-Free (MS13-037) (2)
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a cr
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 9 - MSHTML CDispNode::InsertSiblingNode Use-After-Free (MS13-037) (1)
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary co
35RISK
open ↗Exploit-DB✓ VexDay Proof
Netgear R7000 - Command Injection
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.B
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 9 - 'jscript9' JavaScriptStackWalker Memory Corruption (MS15-056)
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 9 - CDoc::ExecuteScriptUri Use-After-Free (MS13-009)
Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary co
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge - CMarkup::EnsureDeleteCFState Use-After-Free (MS15-125)
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
35RISK
open ↗Exploit-DB✓ VexDay Proof
Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap
An elevation of privilege vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 coul
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge - JSON.parse Info Leak
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of
45RISK
open ↗Exploit-DB✓ VexDay Proof
Apache CouchDB 2.0.0 - Local Privilege Escalation
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in t
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Event Viewer 1.0 - XML External Entity Injection
Windows Event Viewer Information Disclosure Vulnerability
38RISK
open ↗Exploit-DB✓ VexDay Proof
Alcatel Lucent Omnivista 8770 - Remote Code Execution
Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP pro
28RISK
open ↗Exploit-DB✓ VexDay Proof
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities
Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan We
23RISK
open ↗Exploit-DB✓ VexDay Proof
NTP 4.2.8p3 - Denial of Service
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 10 - MSHTML 'CEditAdorner::Detach' Use-After-Free (MS13-047)
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory co
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 8/9/10/11 - MSHTML 'DOMImplementation' Type Confusion (MS16-009)
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service
35RISK
open ↗Exploit-DB✓ VexDay Proof
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities
Multiple stored Cross-Site-Scripting (XSS) vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in
23RISK
open ↗Exploit-DB✓ VexDay Proof
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities
Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtua
23RISK
open ↗Exploit-DB✓ VexDay Proof
Red Hat JBoss EAP - Deserialization of Untrusted Data
The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to caus
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 8 - MSHTML 'SRunPointer::SpanQualifier/RunType' Out-Of-Bounds Read (MS15-009)
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memo
35RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method)
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗Exploit-DB✓ VexDay Proof
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities
Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appli
28RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method)
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗Exploit-DB✓ VexDay Proof
GNU Wget < 1.18 - Access List Bypass / Race Condition
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow
23RISK
open ↗Exploit-DB✓ VexDay Proof
Crestron AM-100 - Multiple Vulnerabilities
Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13
28RISK
open ↗Exploit-DB✓ VexDay Proof
Huawei UTPS - Unquoted Service Path Privilege Escalation
Huawei UTPS earlier than UTPS-V200R003B015D16SPC00C983 has an unquoted service path vulnerability which can lead to the
23RISK
open ↗Exploit-DB✓ VexDay Proof
D-Link DIR-Series Routers - HNAP Login Stack Buffer Overflow (Metasploit)
D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Edge - 'CTextExtractor::GetBlockText' Out-of-Bounds Read (MS16-104)
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of
45RISK
open ↗Exploit-DB✓ VexDay Proof
NTP 4.2.8p8 - Denial of Service
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf
35RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.