Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,697cataloged exploits
36,715CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,264GitHub PoC 15,172VulnCheck XDB 8,920Nuclei 4,373Metasploit 3,493✓ verified onlyrecentpopularrisk
79,697 exploits
Exploit-DB
TP-Link WR840N 0.9.1 3.16 - Denial of Service (PoC)
CVE-2018-15172—doshardware16 Aug 2018
TP-Link WR840N devices have a buffer overflow via a long Authorization HTTP header.
23RISK
open ↗
GitHub PoC★ 1
CVE-2018-8120 Windows LPE exploit
CVE-2018-8120HIGHunder attackransomware16 Aug 2018
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
100RISK
open ↗
Exploit-DB
WebkitGTK+ 2.20.3 - 'ImageBufferCairo::getImageData()' Buffer Overflow (PoC)
CVE-2018-12293—locallinux16 Aug 2018
The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKi
28RISK
open ↗
Exploit-DB
Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2018-14058—webappsphp16 Aug 2018
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
43RISK
open ↗
Exploit-DB
Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery
CVE-2018-14059—webappsphp16 Aug 2018
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick,
23RISK
open ↗
Exploit-DB
JioFi 4G M2S 1.0.2 - Denial of Service (PoC)
CVE-2018-15181—doshardware15 Aug 2018
JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service (secure configuration outage) via an XSS paylo
23RISK
open ↗
Exploit-DB
ASUSTOR ADM 3.1.0.RFQ3 - Remote Command Execution / SQL Injection
CVE-2018-11510—webappscgi15 Aug 2018
The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/
35RISK
open ↗
Exploit-DB
ASUSTOR ADM 3.1.0.RFQ3 - Remote Command Execution / SQL Injection
CVE-2018-11511—webappscgi15 Aug 2018
The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability
43RISK
open ↗
Exploit-DB
ASUSTOR ADM 3.1.0.RFQ3 - Remote Command Execution / SQL Injection
CVE-2018-11509—webappscgi15 Aug 2018
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applicat
28RISK
open ↗
Exploit-DB
cgit 1.2.1 - Directory Traversal (Metasploit)
CVE-2018-14912—webappslinux14 Aug 2018
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned
60RISK
open ↗
GitHub PoC★ 259
PoC for CVE-2018-15133 (Laravel unserialize vulnerability)
CVE-2018-15133HIGHunder attack14 Aug 2018
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle GlassFish Server Open Source Edition 4.1 - Path Traversal (Metasploit)
CVE-2017-1000028—webappswindows14 Aug 2018
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-15133HIGHunder attack14 Aug 2018
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISK
open ↗
Exploit-DB
Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit)
CVE-2018-6892—remotewindows_x86-6414 Aug 2018
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Exploit-DB
Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
CVE-2017-1000028—webappslinux14 Aug 2018
Oracle, GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated Directory Trave
60RISK
open ↗
Exploit-DB
PostgreSQL 9.4-0.5.3 - Privilege Escalation
CVE-2017-14798HIGHlocallinux13 Aug 2018
local privilege escalation in SUSE postgresql init script
41RISK
open ↗
GitHub PoC
kaisaryousuf/CVE-2018-8208
CVE-2018-8208—13 Aug 2018
An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual regis
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Android - Directory Traversal over USB via Injection in blkid Output
CVE-2018-9445—localandroid13 Aug 2018
In readMetadata of Utils.cpp, there is a possible path traversal bug due to a confused deputy. This could lead to local
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit)
CVE-2018-2628CRITICALunder attackremotewindows13 Aug 2018
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
open ↗
Exploit-DB✓ VexDay Proof
IBM Sterling B2B Integrator 5.2.0.1/5.2.6.3 - Cross-Site Scripting
CVE-2018-1563MEDIUMwebappsmultiple13 Aug 2018
IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) is vulnerable to cross-site
33RISK
open ↗
Metasploit300
Pimcore Gather Credentials via SQL Injection
CVE-2018-14058—13 Aug 2018
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
43RISK
open ↗
Exploit-DB✓ VexDay Proof
IBM Sterling B2B Integrator 5.2.0.1/5.2.6.3 - Cross-Site Scripting
CVE-2018-1513MEDIUMwebappsmultiple13 Aug 2018
IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerabili
33RISK
open ↗
Exploit-DB
Zimbra 8.6.0_GA_1153 - Cross-Site Scripting
CVE-2016-3411—webappsphp10 Aug 2018
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrar
23RISK
open ↗
Exploit-DB
MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting
CVE-2018-14888—webappsphp10 Aug 2018
inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or threa
23RISK
open ↗
Exploit-DB
reSIProcate 1.10.2 - Heap Overflow
CVE-2018-12584—dosmultiple09 Aug 2018
The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows rem
28RISK
open ↗
Exploit-DB
Linux Kernel 4.14.7 (Ubuntu 16.04 / CentOS 7) - (KASLR & SMEP Bypass) Arbitrary File Read
CVE-2017-18344—locallinux09 Aug 2018
The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly
23RISK
open ↗
GitHub PoC★ 178
Exploit for CVE-2018-4233, a WebKit JIT optimization bug used during Pwn2Own 2018
CVE-2018-4233HIGH08 Aug 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud
68RISK
open ↗
Exploit-DB
osTicket 1.10.1 - Arbitrary File Upload
CVE-2017-15580—webappswindows08 Aug 2018
osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly v
28RISK
open ↗
VulnCheck XDB
client-side
CVE-2018-4233HIGH08 Aug 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud
68RISK
open ↗
GitHub PoC★ 119
Implements the POP/MOV SS (CVE-2018-8897) vulnerability by leveraging SYSCALL to perform a local privilege escalation (LPE).
CVE-2018-8897—08 Aug 2018
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
43RISK
open ↗
← previouspage 885 / 2,657next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.