Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
3,528 exploits
Metasploit300
SSH Login Check Scanner
A Unix account has a default, null, blank, or missing password.
50RISK
open ↗Metasploit300
SSH Version Scanner
Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2
28RISK
open ↗Metasploit300
Telnet Service Encryption Key ID Overflow Detection
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka k
60RISK
open ↗Metasploit300
UPnP SSDP M-SEARCH Information Discovery
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable
60RISK
open ↗Metasploit300
SSDP ssdp:all M-SEARCH Amplification Scanner
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service
60RISK
open ↗Metasploit300
UDP Amplification Scanner
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service
60RISK
open ↗Metasploit300
Brocade Enable Login Check Scanner
A Unix account has a default, null, blank, or missing password.
50RISK
open ↗Metasploit300
RuggedCom Telnet Password Generator
RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Ad
50RISK
open ↗Metasploit300
Ruby On Rails File Content Disclosure ('doubletap')
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISK
open ↗Metasploit300
Telnet Login Check Scanner
A Unix account has a default, null, blank, or missing password.
50RISK
open ↗Metasploit300
Peplink Balance routers SQLi
SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw
50RISK
open ↗Metasploit300
Adobe ColdFusion Unauthenticated Arbitrary File Read
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RISK
open ↗Metasploit300
Acronis Cyber Protect/Backup machine info disclosure
Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Prot
43RISK
open ↗Metasploit300
Acronis Cyber Protect/Backup machine info disclosure
Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following
43RISK
open ↗Metasploit300
BADPDF Malicious PDF Creator
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier
40RISK
open ↗Metasploit300
SolarWinds Serv-U Unauthenticated Arbitrary File Read
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗Metasploit300
Twonky Server Log Leak Authentication Bypass
Hard-coded encryption keys in Twonky Server
36RISK
open ↗Metasploit300
Twonky Server Log Leak Authentication Bypass
Unauthenticated log access in Twonky Server
75RISK
open ↗Metasploit300
Apache "mod_userdir" User Enumeration
Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists a
50RISK
open ↗Metasploit300
Atlassian Crowd XML Entity Expansion Remote File Access
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible bef
50RISK
open ↗Metasploit300
Apache Axis2 Brute Force Utility
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products
60RISK
open ↗Metasploit300
Binom3 Web Management Login Scanner, Config and Password File Dump
An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Lack of authentication for rem
23RISK
open ↗Metasploit300
Cassandra Web File Read Vulnerability
Cassandra Web 0.5.0 - Remote File Read
36RISK
open ↗Metasploit300
Cisco Network Access Manager Directory Traversal Vulnerability
Directory traversal vulnerability in Cisco Network Admission Control (NAC) Manager 4.8.x allows remote attackers to read
23RISK
open ↗Metasploit300
Cambium cnPilot r200/r201 Login Scanner and Config Dump
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration fil
18RISK
open ↗Metasploit300
ColdFusion Server Check
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow re
100RISK
open ↗Metasploit300
Dell iDRAC Default Login
A Unix account has a default, null, blank, or missing password.
50RISK
open ↗Metasploit300
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-
60RISK
open ↗Metasploit300
MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode U
60RISK
open ↗Metasploit300
D-Link DIR-300A / DIR-320 / DIR-615D HTTP Login Utility
A Unix account has a default, null, blank, or missing password.
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.