Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
79,305 exploits
GitHub PoC★ 9
CVE-2019-10149 privilege escalation
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
open ↗VulnCheck XDB
local
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
open ↗VulnCheck XDB
denial-of-service
ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access
28RISK
open ↗VulnCheck XDB
initial-access
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup
100RISK
open ↗Metasploit300
Cisco Data Center Network Manager Unauthenticated File Download
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗Metasploit600
Cisco Data Center Network Manager Unauthenticated Remote Code Execution
Cisco Data Center Network Manager Information Disclosure Vulnerability
70RISK
open ↗Metasploit300
Cisco Data Center Network Manager Unauthenticated File Download
Cisco Data Center Network Manager Arbitrary File Download Vulnerability
41RISK
open ↗Metasploit600
Cisco Data Center Network Manager Unauthenticated Remote Code Execution
Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
85RISK
open ↗Metasploit600
Cisco Data Center Network Manager Unauthenticated Remote Code Execution
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗GitHub PoC★ 1
spectre v4 : Speculative Store Bypass (CVE-2018-3639) proof of concept for Linux
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
45RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow
83RISK
open ↗Exploit-DB✓ VexDay Proof
Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP r
60RISK
open ↗Exploit-DB✓ VexDay Proof
Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution (Metasploit)
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
50RISK
open ↗GitHub PoC★ 99
cve-2019-0604 SharePoint RCE exploit
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup
100RISK
open ↗VulnCheck XDB
initial-access
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
45RISK
open ↗GitHub PoC
CVE-2017-8759 微软word漏洞利用脚本
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely vi
93RISK
open ↗VulnCheck XDB
client-side
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely vi
93RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows Font Cache Service - Insecure Sections Privilege Escalation
Windows ALPC Elevation of Privilege Vulnerability
23RISK
open ↗Exploit-DB
SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.
23RISK
open ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗GitHub PoC★ 14
POC CVE-2019-0708 with python script!
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗Exploit-DB
SeedDMS versions < 5.1.11 - Remote Command Execution
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a differe
28RISK
open ↗Exploit-DB
SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting
out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Nam
23RISK
open ↗GitHub PoC★ 70
Weblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗Exploit-DB
dotProject 2.1.9 - SQL Injection
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - 'CmpAddRemoveContainerToCLFSLog' Arbitrary File/Directory Creation
Windows Common Log File System Driver Elevation of Privilege Vulnerability
41RISK
open ↗Exploit-DB
GrandNode 4.40 - Path Traversal / Arbitrary File Download
A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows
50RISK
open ↗GitHub PoC
Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗GitHub PoC★ 5
CVE-2018-17456漏洞复现（PoC+Exp）
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x be
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.