Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,980cataloged exploits
36,899CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,400GitHub PoC 15,250VulnCheck XDB 8,959Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
24,476 exploits
Exploit-DB
Ability Mail Server 3.3.2 - Cross-Site Scripting
CVE-2017-17752—webappsmultiple20 Dec 2017
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code execute
23RISK
open ↗
Exploit-DB
Samsung Internet Browser - SOP Bypass (Metasploit)
CVE-2017-17692—remoteandroid20 Dec 2017
Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Internet Explorer 11 - 'jscript!JSONStringifyObject' Use-After-Free
CVE-2017-11793—doswindows19 Dec 2017
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Intel Content Protection HECI Service - Type Confusion Privilege Escalation
CVE-2017-5717—doswindows19 Dec 2017
Type Confusion in Content Protection HECI Service in Intel Graphics Driver allows unprivileged user to elevate privilege
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - jscript.dll 'Array.sort' Heap Overflow
CVE-2017-11907—doswindows19 Dec 2017
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Tuleap 9.6 - Second-Order PHP Object Injection (Metasploit)
CVE-2017-7411—remotephp19 Dec 2017
An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentEl
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!NameTbl::GetValDef' Use-After-Free
CVE-2017-11903—doswindows19 Dec 2017
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!RegExpComp::Compile' Heap Overflow Through IE or Local Network via WPAD
CVE-2017-11890—doswindows19 Dec 2017
Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Win
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!JsArraySlice' Uninitialized Variable
CVE-2017-11855—doswindows19 Dec 2017
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Window
35RISK
open ↗
Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
CVE-2017-17738—webappshardware19 Dec 2017
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools
23RISK
open ↗
Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
CVE-2017-17739—webappshardware19 Dec 2017
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Jenkins - XStream Groovy classpath Deserialization (Metasploit)
CVE-2016-0792—remotemultiple19 Dec 2017
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
60RISK
open ↗
Exploit-DB
Ichano AtHome IP Cameras - Multiple Vulnerabilities
CVE-2017-17761—remotehardware19 Dec 2017
An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 130
23RISK
open ↗
Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
CVE-2017-14096—remotemultiple19 Dec 2017
A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and b
23RISK
open ↗
Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
CVE-2017-14095—remotemultiple19 Dec 2017
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe
28RISK
open ↗
Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
CVE-2017-14094—remotemultiple19 Dec 2017
A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - 'jscript!RegExpFncObj::LastParen' Out-of-Bounds Read
CVE-2017-11906—doswindows19 Dec 2017
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Se
28RISK
open ↗
Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
CVE-2017-11398—remotemultiple19 Dec 2017
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 an
23RISK
open ↗
Exploit-DB
Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
CVE-2017-14097—remotemultiple19 Dec 2017
An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below coul
28RISK
open ↗
Exploit-DB
BrightSign Digital Signage - Multiple Vulnerablities
CVE-2017-17737—webappshardware19 Dec 2017
The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diag
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Zoom Linux Client 2.0.106600.0904 - Stack-Based Buffer Overflow (PoC)
CVE-2017-15048—doslinux18 Dec 2017
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Zoom Linux Client 2.0.106600.0904 - Command Injection
CVE-2017-15049—doslinux18 Dec 2017
The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when c
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Western Digital MyCloud - 'multi_uploadify' File Upload (Metasploit)
CVE-2017-17560—remotephp18 Dec 2017
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquer
60RISK
open ↗
Exploit-DB✓ VexDay Proof
GoAhead Web Server 2.5 < 3.6.5 - HTTPd 'LD_PRELOAD' Remote Code Execution
CVE-2017-17562HIGHunder attackremotelinux18 Dec 2017
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISK
open ↗
Exploit-DB
Linux kernel < 4.10.15 - Race Condition Privilege Escalation
CVE-2017-10661—locallinux15 Dec 2017
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denia
28RISK
open ↗
Exploit-DB
Sync Breeze 10.2.12 - Denial of Service
CVE-2017-17088—doswindows15 Dec 2017
The Enterprise version of SyncBreeze 10.2.12 and earlier is affected by a Remote Denial of Service vulnerability. The we
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Palo Alto Networks Firewalls - Root Remote Code Execution
CVE-2017-15944CRITICALunder attackremotehardware14 Dec 2017
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
100RISK
open ↗
Exploit-DB
Piwigo 2.9.1 - 'cat_true' / 'cat_false' SQL Injection
CVE-2017-10682—webappsphp14 Dec 2017
SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitra
23RISK
open ↗
Exploit-DB
Readymade Video Sharing Script 3.2 - HTML Injection
CVE-2017-17649—webappsphp14 Dec 2017
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Advantech WebAccess 8.2-2017.03.31 - Webvrpcs Service Opcode 80061 Stack Buffer Overflow (Metasploit)
CVE-2017-14016—webappswindows14 Dec 2017
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. The applicati
43RISK
open ↗
← previouspage 117 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.