Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
79,305 exploits
GitHub PoC★ 20
CVE-2019-16759 vbulletin 5.0.0 till 5.5.4 pre-auth rce
CVE-2019-16759CRITICALunder attack02 Oct 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Exploit-DB✓ VexDay Proof
DOUBLEPULSAR - Payload Execution and Neutralization (Metasploit)
CVE-2017-0143HIGHunder attackransomwareremotewindows02 Oct 2019
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗
GitHub PoC★ 1
CVE-2019-17080
CVE-2019-17080—02 Oct 2019
mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by a
23RISK
open ↗
Exploit-DB
DotNetNuke < 9.4.0 - Cross-Site Scripting
CVE-2019-12562—webappsmultiple01 Oct 2019
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the mali
23RISK
open ↗
Exploit-DB
vBulletin 5.x - Remote Command Execution (Metasploit)
CVE-2019-16759CRITICALunder attackwebappsphp30 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Exploit-DB
WordPress Plugin ARforms 3.7.1 - Arbitrary File Deletion
CVE-2019-16902—webappsphp30 Sep 2019
In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an
23RISK
open ↗
Exploit-DB
phpIPAM 1.4 - SQL Injection
CVE-2019-16692—webappsphp30 Sep 2019
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is us
28RISK
open ↗
Exploit-DB
Cisco Small Business 220 Series - Multiple Vulnerabilities
CVE-2019-1912CRITICALremotehardware30 Sep 2019
Cisco Small Business 220 Series Smart Switches Authentication Bypass Vulnerability
53RISK
open ↗
Exploit-DB
Cisco Small Business 220 Series - Multiple Vulnerabilities
CVE-2019-1913CRITICALremotehardware30 Sep 2019
Cisco Small Business 220 Series Smart Switches Remote Code Execution Vulnerabilities
53RISK
open ↗
Exploit-DB
GoAhead 2.5.0 - Host Header Injection
CVE-2019-16645—remotemultiple30 Sep 2019
An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) cre
23RISK
open ↗
Exploit-DB
Cisco Small Business 220 Series - Multiple Vulnerabilities
CVE-2019-1914HIGHremotehardware30 Sep 2019
Cisco Small Business 220 Series Smart Switches Command Injection Vulnerability
46RISK
open ↗
GitHub PoC
A simple exploit for CVE-2007-2447
CVE-2007-2447—30 Sep 2019
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗
GitHub PoC★ 245
ispy V1.0 - Eternalblue(ms17-010)/Bluekeep(CVE-2019-0708) Scanner and exploit ( Metasploit automation )
CVE-2019-0708CRITICALunder attackransomware30 Sep 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 75
it works on xp (all version sp2 sp3)
CVE-2019-0708CRITICALunder attackransomware29 Sep 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2019-11708CRITICALunder attack29 Sep 2019
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result
90RISK
open ↗
GitHub PoC★ 21
PoC of CVE-2018-14847 Mikrotik Vulnerability using simple script
CVE-2018-14847CRITICALunder attack29 Sep 2019
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗
GitHub PoC★ 624
Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.
CVE-2019-11708CRITICALunder attack29 Sep 2019
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result
90RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-14847CRITICALunder attack29 Sep 2019
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2019-9810—29 Sep 2019
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check
28RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2019-8451—28 Sep 2019
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the con
60RISK
open ↗
GitHub PoC★ 5
Exploit code for CVE-2019-16692
CVE-2019-16692—27 Sep 2019
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is us
28RISK
open ↗
GitHub PoC★ 21
vBulletin 5.x 未授权远程代码执行漏洞
CVE-2019-16759CRITICALunder attack26 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
GitHub PoC★ 3
Nmap NSE Script to Detect vBulletin pre-auth 5.x RCE CVE-2019-16759
CVE-2019-16759CRITICALunder attack26 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
Metasploit600
Android Binder Use-After-Free Exploit
CVE-2019-2215HIGHunder attack26 Sep 2019
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-16759CRITICALunder attack26 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-16759CRITICALunder attack26 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2019-8451—26 Sep 2019
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the con
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2018-14847CRITICALunder attack25 Sep 2019
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-16759CRITICALunder attack25 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
GitHub PoC★ 5
Vbulletin rce exploit CVE-2019-16759
CVE-2019-16759CRITICALunder attack25 Sep 2019
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge
100RISK
open ↗
← previouspage 814 / 2,644next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.