Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
3,528 exploits
Metasploit300
TrendMicro ServerProtect File Access
SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous
30RISK
open ↗Metasploit300
TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access
Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in th
23RISK
open ↗Metasploit300
Cisco Secure ACS Unauthorized Password Change
The web-based management interface in Cisco Secure Access Control System (ACS) 5.1 before 5.1.0.44.6 and 5.2 before 5.2.
23RISK
open ↗Metasploit300
Cisco ASA Authentication Bypass (EXTRABACON)
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Service
100RISK
open ↗Metasploit300
Ulterius Server File Download Vulnerability
The Process function in RemoteTaskServer/WebServer/HttpServer.cs in Ulterius before 1.9.5.0 allows HTTP server directory
60RISK
open ↗Metasploit300
TYPO3 sa-2010-020 Remote File Disclosure
The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before
43RISK
open ↗Metasploit300
Novell File Reporter Agent Arbitrary File Delete
NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pa
23RISK
open ↗Metasploit300
JBoss JMX Console DeploymentFileRepository WAR Upload and Deployment
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2
95RISK
open ↗Metasploit300
JBoss JMX Console Beanshell Deployer WAR Upload and Deployment
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2
95RISK
open ↗Metasploit300
Iomega StorCenter Pro NAS Web Authentication Bypass
cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack
23RISK
open ↗Metasploit300
ContentKeeper Web Appliance mimencode File Access
ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode
36RISK
open ↗Metasploit300
Cambium cnPilot r200/r201 File Path Traversal
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web ad
18RISK
open ↗Metasploit300
Cambium cnPilot r200/r201 Command Execution as 'root'
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web
30RISK
open ↗Metasploit300
Diagnostics Agent in Solution Manager, stores unencrypted credentials for Solution Manager server
Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as So
18RISK
open ↗Metasploit300
Bypass the macOS TCC Framework
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue
78RISK
open ↗Metasploit300
Novell eDirectory eMBox Unauthenticated File Access
The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on clien
50RISK
open ↗Metasploit300
Novell eDirectory DHOST Predictable Session Cookie
The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote att
50RISK
open ↗Metasploit300
Active Directory Certificate Services (ADCS) privilege escalation (Certifried)
Active Directory Domain Services Elevation of Privilege Vulnerability
100RISK
open ↗Metasploit300
Windows Pulse Secure Connect Client Saved Password Extractor
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settin
23RISK
open ↗Metasploit300
Windows Gather TeamViewer Passwords
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for dif
86RISK
open ↗Metasploit300
Netlogon Weak Cryptographic Authentication
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗Metasploit300
Veritas Backup Exec Server Registry Access
VERITAS Backup Exec Server (beserver.exe) 9.0 through 10.0 for Windows allows remote unauthenticated attackers to modify
30RISK
open ↗Metasploit300
Veritas Backup Exec Windows Remote File Access
VERITAS Backup Exec for Windows Servers 8.6 through 10.0, Backup Exec for NetWare Servers 9.0 and 9.1, and NetBackup for
60RISK
open ↗Metasploit300
Android Browser RCE Through Google Play Store XFO
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribu
23RISK
open ↗Metasploit300
Windows Gather Forensics Duqu Registry Check
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Wind
88RISK
open ↗Metasploit300
FannyBMP or DementiaWheel Detection Registry Check
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 all
100RISK
open ↗Metasploit300
Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application
23RISK
open ↗Metasploit300
Viproy CUCDM IP Phone XML Services - Call Forwarding Tool
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager (CDM) in Unified CDM Application
23RISK
open ↗Metasploit300
IPv6 Router Advertisement DNS Takeover (RDNSS IPv6 DNS coercion)
Windows HTTP.sys Elevation of Privilege Vulnerability
36RISK
open ↗Metasploit300
DHCPv6 DNS Takeover (mitm6-style IPv6 DNS coercion)
Windows HTTP.sys Elevation of Privilege Vulnerability
36RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.