Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits

35,961CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecent popular risk

77,893 exploits

GitHub PoC★ 1

a python3 version of the exploit written for CVE-2014-6287. Useful for completing the "Steel Mountain" room on TryHackMe.com without the use of metasploit.

CVE-2014-6287CRITICALunder attack03 Dec 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

VulnCheck XDB

initial-access

CVE-2014-6287CRITICALunder attack03 Dec 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

GitHub PoC

sinisterghost/https-github.com-iBearcat-CVE-2018-8174_EXP

CVE-2018-8174HIGHunder attackransomware03 Dec 2021

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows

93RISK

Metasploit600

Ivanti Cloud Services Appliance (CSA) Command Injection

CVE-2021-44529CRITICALunder attackransomware02 Dec 2021

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

100RISK

Metasploit300

Grafana Plugin Path Traversal

CVE-2021-43798HIGHunder attack02 Dec 2021

Grafana path traversal

100RISK

VulnCheck XDB

initial-access

CVE-2014-6287CRITICALunder attack02 Dec 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

VulnCheck XDB

local

CVE-2021-41379MEDIUMunder attackransomware02 Dec 2021

Windows Installer Elevation of Privilege Vulnerability

68RISK

VulnCheck XDB

remote-with-credentials

CVE-2018-9995—02 Dec 2021

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

50RISK

VulnCheck XDB

infoleak

CVE-2020-17519CRITICALunder attack02 Dec 2021

Apache Flink directory traversal attack: reading remote files through the REST API

100RISK

VulnCheck XDB

initial-access

CVE-2021-25646—02 Dec 2021

Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

60RISK

VulnCheck XDB

initial-access

CVE-2019-12725—02 Dec 2021

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web ap

60RISK

GitHub PoC

A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287

CVE-2014-6287CRITICALunder attack02 Dec 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

GitHub PoC★ 1

CVE-2021-42325 POC

CVE-2021-42325—02 Dec 2021

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

28RISK

VulnCheck XDB

infoleak

CVE-2021-21402HIGH02 Dec 2021

Unauthenticated Arbitrary File Access in Jellyfin

78RISK

GitHub PoC

dearpan/cve-2018-9995

CVE-2018-9995—02 Dec 2021

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

50RISK

Exploit-DB

Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting

CVE-2021-40577—webappsphp01 Dec 2021

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP an

23RISK

VulnCheck XDB

remote-with-credentials

CVE-2021-1675HIGHunder attackransomware01 Dec 2021

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

VulnCheck XDB

local

CVE-2021-30807HIGHunder attack30 Nov 2021

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS

76RISK

GitHub PoC★ 3

CVE-2021-43778 poc

CVE-2021-43778CRITICAL30 Nov 2021

Path traversal in GLPI barcode plugin

75RISK

GitHub PoC★ 1

Sigma-Rule-for-CVE-2021-40438-Attack-Attemp

CVE-2021-40438CRITICALunder attackransomware30 Nov 2021

mod_proxy SSRF

100RISK

GitHub PoC★ 5

Gex is an iOS 14.7 jailbreak using CVE-2021-30807 IOMFB & CVE-2021-30860 exploit(s)

CVE-2021-30807HIGHunder attack30 Nov 2021

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS

76RISK

VulnCheck XDB

infoleak

CVE-2021-43778CRITICAL30 Nov 2021

Path traversal in GLPI barcode plugin

75RISK

VulnCheck XDB

initial-access

CVE-2021-41653—29 Nov 2021

The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r

60RISK

VulnCheck XDB

initial-access

CVE-2020-11978HIGHunder attack28 Nov 2021

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco

100RISK

VulnCheck XDB

remote-with-credentials

CVE-2021-42321HIGHunder attackransomware27 Nov 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

VulnCheck XDB

remote-with-credentials

CVE-2019-19609—27 Nov 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

GitHub PoC★ 1

NSE script to fingerprint if GitLab is vulnerable to cve-2021-22205-nse

CVE-2021-22205CRITICALunder attackransomware27 Nov 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

100RISK

GitHub PoC

Strapi Framework, 3.0.0-beta.17.4

CVE-2019-19609—27 Nov 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

VulnCheck XDB

infoleak

CVE-2021-22205CRITICALunder attackransomware27 Nov 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

100RISK

VulnCheck XDB

initial-access

CVE-2021-21985CRITICALunder attackransomware26 Nov 2021

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.