Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits

36,465CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecent popular risk

79,212 exploits

GitHub PoC★ 1

*CVE-2014-6271* Unix Arbitrary Code Execution Exploit commonly know as Shell Shock. Examples, Docs, Incident Response and Vulnerability/Risk Assessment, and Additional Resources may be dumped here. Enjoy :) --- somhmxxghoul ---

CVE-2014-6271CRITICALunder attack28 Jan 2020

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

VulnCheck XDB

client-side

CVE-2020-0601HIGHunder attack28 Jan 2020

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RISK

GitHub PoC★ 73

PoC script that shows RCE vulnerability over Intellian Satellite controller

CVE-2020-7980—28 Jan 2020

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to th

60RISK

Exploit-DB✓ VexDay Proof

Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password)

CVE-2020-7991—webappsphp28 Jan 2020

Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.

23RISK

VulnCheck XDB

initial-access

CVE-2020-7980—28 Jan 2020

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to th

60RISK

GitHub PoC★ 20

PoC for CVE-2020-0601 - CryptoAPI exploit

CVE-2020-0601HIGHunder attack28 Jan 2020

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RISK

GitHub PoC★ 1

Python CVE-2019-19781 exploit

CVE-2019-19781CRITICALunder attackransomware28 Jan 2020

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

Exploit-DB

Microsoft Windows Kernel - Information Disclosure

CVE-2019-1125MEDIUMlocalwindows27 Jan 2020

Windows Kernel Information Disclosure Vulnerability

33RISK

Metasploit600

Centreon Poller Authenticated Remote Command Execution

CVE-2019-19699—27 Jan 2020

There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers mi

23RISK

GitHub PoC★ 41

This repository contains the sources and documentation for the SWAPGS attack PoC (CVE-2019-1125)

CVE-2019-1125MEDIUM27 Jan 2020

Windows Kernel Information Disclosure Vulnerability

33RISK

VulnCheck XDB

initial-access

CVE-2022-22947CRITICALunder attack25 Jan 2020

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RISK

GitHub PoC

PoC for "CurveBall" CVE-2020-0601

CVE-2020-0601HIGHunder attack25 Jan 2020

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RISK

GitHub PoC★ 78

PoC for the Remote Desktop Gateway vulnerability - CVE-2020-0609 & CVE-2020-0610

CVE-2020-0609—24 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RISK

GitHub PoC★ 68

A proof-of-concept scanner to check an RDG Gateway Server for vulnerabilities CVE-2020-0609 & CVE-2020-0610.

CVE-2020-0609—24 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RISK

GitHub PoC

Citrix ADC (NetScaler) Honeypot. Supports detection for CVE-2019-19781 and login attempts

CVE-2019-19781CRITICALunder attackransomware24 Jan 2020

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

GitHub PoC★ 2

Archi73ct/CVE-2020-0609

CVE-2020-0609—24 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RISK

Exploit-DB

Genexis Platinum-4410 2.1 - Authentication Bypass

CVE-2020-6170—webappshardware24 Jan 2020

An authentication bypass vulnerability on Genexis Platinum-4410 v2.1 P4410-V2 1.28 devices allows attackers to obtain cl

23RISK

Exploit-DB

TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot

CVE-2019-16893—webappshardware24 Jan 2020

The Web Management of TP-Link TP-SG105E V4 1.0.0 Build 20181120 devices allows an unauthenticated attacker to reboot the

35RISK

Exploit-DB✓ VexDay Proof

Reliable Datagram Sockets (RDS) - rds_atomic_free_op NULL pointer dereference Privilege Escalation (Metasploit)

CVE-2018-5333—locallinux23 Jan 2020

In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning

38RISK

Exploit-DB✓ VexDay Proof

Reliable Datagram Sockets (RDS) - rds_atomic_free_op NULL pointer dereference Privilege Escalation (Metasploit)

CVE-2019-9213—locallinux23 Jan 2020

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which make

38RISK

VulnCheck XDB

client-side

CVE-2020-0601HIGHunder attack23 Jan 2020

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RISK

Exploit-DB

qdPM 9.1 - Remote Code Execution

CVE-2020-7246—webappsphp23 Jan 2020

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code

60RISK

Exploit-DB

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

CVE-2020-0610—doswindows23 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

35RISK

GitHub PoC

a script to look for CVE-2019-19781 Vulnerability within a domain and it's subdomains

CVE-2019-19781CRITICALunder attackransomware23 Jan 2020

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

GitHub PoC

My Citrix ADC NetScaler CVE-2019-19781 Vulnerability DFIR notes.

CVE-2019-19781CRITICALunder attackransomware23 Jan 2020

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

Exploit-DB

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

CVE-2020-0610—doswindows23 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

35RISK

GitHub PoC

:microscope: Jupyter notebook to help automate some of the forensic analysis related to Citrix Netscalers compromised via CVE-2019-19781

CVE-2019-19781CRITICALunder attackransomware23 Jan 2020

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

GitHub PoC★ 1

CVE-2020-0601: Windows CryptoAPI Vulnerability. (CurveBall/ChainOfFools)

CVE-2020-0601HIGHunder attack23 Jan 2020

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c

93RISK

Exploit-DB

Remote Desktop Gateway - 'BlueGate' Denial of Service (PoC)

CVE-2020-0609—doswindows23 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RISK

GitHub PoC★ 249

PoC (DoS + scanner) for CVE-2020-0609 & CVE-2020-0610 - RD Gateway RCE

CVE-2020-0609—23 Jan 2020

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated atta

45RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.