Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,697cataloged exploits
36,715CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,264GitHub PoC 15,172VulnCheck XDB 8,920Nuclei 4,373Metasploit 3,493✓ verified onlyrecentpopularrisk
79,596 exploits
Exploit-DB
PayPal-Credit Card-Debit Card Payment 1.0 - SQL Injection
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=
23RISK
open ↗Exploit-DB
ASRock Drivers - Privilege Escalation
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISK
open ↗Exploit-DB
Paramiko 2.4.1 - Authentication Bypass
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x
28RISK
open ↗Exploit-DB
School Attendance Monitoring System 1.0 - Cross-Site Request Forgery (Update Admin)
School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
23RISK
open ↗Exploit-DB
School Event Management System 1.0 - Arbitrary File Upload
School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
23RISK
open ↗Exploit-DB
K-iwi Framework 1775 - SQL Injection
K-iwi Framework 1775 has SQL Injection via the admin/user/group/update user_group_id parameter or the admin/user/user/up
23RISK
open ↗Exploit-DB
Modbus Slave 7.0.0 - Denial of Service (PoC)
Modbus Slave 7.0.0 in modbus tools has a Buffer Overflow.
23RISK
open ↗Exploit-DB
School Attendance Monitoring System 1.0 - SQL Injection
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph
23RISK
open ↗Exploit-DB
Bakeshop Inventory System in VB.Net and MS Access Database 1.0 - SQL Injection
Bakeshop Inventory System 1.0 has SQL injection via the login screen, related to include/publicfunction.vb.
23RISK
open ↗Exploit-DB
School Attendance Monitoring System 1.0 - Arbitrary File Upload
School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
23RISK
open ↗Exploit-DB
ASRock Drivers - Privilege Escalation
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISK
open ↗Exploit-DB
School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin)
School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.
23RISK
open ↗Exploit-DB
ASRock Drivers - Privilege Escalation
The AsrDrv101.sys and AsrDrv102.sys low-level drivers in ASRock RGBLED before v1.0.35.1, A-Tuning before v3.0.210, F-Str
23RISK
open ↗GitHub PoC★ 4
Exploit for vulnerability CVE-2018-6389 on wordpress sites
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the
45RISK
open ↗VulnCheck XDB
local
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISK
open ↗GitHub PoC★ 17
OpenBsd_CVE-2018-14665
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISK
open ↗Exploit-DB✓ VexDay Proof
WebEx - Local Service Permissions Exploit (Metasploit)
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
61RISK
open ↗Exploit-DB
User Management 1.1 - Cross-Site Scripting
Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filen
23RISK
open ↗Exploit-DB
AjentiCP 1.2.23.13 - Cross-Site Scripting
ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in Fi
23RISK
open ↗Exploit-DB
xorg-x11-server < 1.20.3 - Local Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISK
open ↗Exploit-DB
ProjeQtOr Project Management Tool 7.2.5 - Remote Code Execution
The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file
23RISK
open ↗Exploit-DB
Ekushey Project Manager CRM 3.1 - Cross-Site Scripting
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as d
23RISK
open ↗Exploit-DB
Adult Filter 1.0 - Buffer Overflow (SEH)
Adult Filter 1.0 has a Buffer Overflow via a crafted Black Domain List file.
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebExec - (Authenticated) User Code Execution (Metasploit)
Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability
61RISK
open ↗Exploit-DB
Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
open ↗Exploit-DB✓ VexDay Proof
libtiff 4.0.9 - Decodes Arbitrarily Sized JBIG into a Target Buffer
LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3
28RISK
open ↗GitHub PoC
ensimag-security/CVE-2018-10933
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISK
open ↗Metasploit400
Xorg X11 Server SUID modulepath Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISK
open ↗Metasploit400
Xorg X11 Server SUID logfile Privilege Escalation
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options wh
43RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.