Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,978cataloged exploits
36,899CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,400GitHub PoC 15,248VulnCheck XDB 8,959Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
24,476 exploits
Exploit-DB✓ VexDay Proof
Firefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution
CVE-2016-2819—remotewindows16 Mar 2018
Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to ex
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Firefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution
CVE-2017-5375—remotewindows16 Mar 2018
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. T
35RISK
open ↗
Exploit-DB
Microsoft Windows Kernel (7 x86) - Local Privilege Escalation (MS17-017)
CVE-2017-0101HIGHunder attackransomwarelocalwindows_x8615 Mar 2018
The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7
83RISK
open ↗
Exploit-DB
MikroTik RouterOS < 6.41.3/6.42rc27 - SMB Buffer Overflow
CVE-2018-7445CRITICALunder attackremotehardware15 Mar 2018
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remot
90RISK
open ↗
Exploit-DB
Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution
CVE-2017-8046—webappsjava15 Mar 2018
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions pri
60RISK
open ↗
Exploit-DB
WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting
CVE-2018-7543—webappsphp15 Mar 2018
Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for
23RISK
open ↗
Exploit-DB
Android DRM Services - Buffer Overflow
CVE-2017-13253—dosandroid15 Mar 2018
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. Thi
23RISK
open ↗
Exploit-DB
SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution
CVE-2018-2380MEDIUMunder attackransomwareremotewindows14 Mar 2018
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information pr
68RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7703—webappsaspx13 Mar 2018
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7705—webappsaspx13 Mar 2018
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mai
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Tuleap 9.17.99.189 - Blind SQL Injection
CVE-2018-7538—webappsphp13 Mar 2018
A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 a
23RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7702—webappsaspx13 Mar 2018
SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e
28RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7704—webappsaspx13 Mar 2018
SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1
23RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7706—webappsaspx13 Mar 2018
Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbit
23RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7707—webappsaspx13 Mar 2018
Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitr
23RISK
open ↗
Exploit-DB
SecurEnvoy SecurMail 9.1.501 - Multiple Vulnerabilities
CVE-2018-7701—webappsaspx13 Mar 2018
Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers
23RISK
open ↗
Exploit-DB
TextPattern 4.6.2 - 'qty' SQL Injection
CVE-2018-7474—webappsphp12 Mar 2018
An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on
23RISK
open ↗
Exploit-DB
DEWESoft X3 SP1 (x64) - Remote Command Execution
CVE-2018-7756—remotewindows_x86-6412 Mar 2018
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution
CVE-2017-16720—webappswindows12 Mar 2018
A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within th
35RISK
open ↗
Exploit-DB
ManageEngine Applications Manager 13.5 - Remote Code Execution (Metasploit)
CVE-2018-7890—webappsjava12 Mar 2018
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The pu
60RISK
open ↗
Exploit-DB
Bacula-Web < 8.0.0-rc2 - SQL Injection
CVE-2017-15367—webappsphp09 Mar 2018
Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access
28RISK
open ↗
Exploit-DB
WebLog Expert Enterprise 9.4 - Denial of Service
CVE-2018-7582—doswindows09 Mar 2018
WebLog Expert Web Server Enterprise 9.4 allows Remote Denial Of Service (daemon crash) via a long HTTP Accept Header to
35RISK
open ↗
Exploit-DB
WebLog Expert Enterprise 9.4 - Authentication Bypass
CVE-2018-7581—localwindows09 Mar 2018
\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions (BUIL
23RISK
open ↗
Exploit-DB
Memcached 1.5.5 - 'Memcrashed ' Insufficient Control of Network Message Volume Denial of Service With Shodan API
CVE-2018-1000115—doslinux08 Mar 2018
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vuln
60RISK
open ↗
Exploit-DB
antMan 0.9.0c - Authentication Bypass
CVE-2018-7739—webappsjava07 Mar 2018
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and
35RISK
open ↗
Exploit-DB
Bravo Tejari Web Portal - Cross-Site Request Forgery
CVE-2018-7216—webappsmultiple06 Mar 2018
Cross-site request forgery (CSRF) vulnerability in esop/toolkit/profile/regData.do in Bravo Tejari Procurement Portal al
23RISK
open ↗
Exploit-DB
Softros Network Time System Server 2.3.4 - Denial of Service
CVE-2018-7658—doswindows06 Mar 2018
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service
35RISK
open ↗
Exploit-DB
Suricata < 4.0.4 - IDS Detection Bypass
CVE-2018-6794—dosmultiple05 Mar 2018
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious se
28RISK
open ↗
Exploit-DB
ActivePDF Toolkit < 8.1.0.19023 - Multiple Memory Corruptions
CVE-2018-7264—doswindows05 Mar 2018
The Pictview image processing library embedded in the ActivePDF toolkit through 2018.1.0.18321 is prone to multiple out
28RISK
open ↗
Exploit-DB
Memcached 1.5.5 - 'Memcrashed' Insufficient Control Network Message Volume Denial of Service (1)
CVE-2018-1000115—doslinux05 Mar 2018
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vuln
60RISK
open ↗
← previouspage 106 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.