Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,432cataloged exploits
34,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,493GitHub PoC 13,618VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
4,217 exploits
Nucleimedium
WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS
CVE-2019-17231—
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
18RISK
open ↗
Nucleihigh
WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export
CVE-2019-17232—
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options im
18RISK
open ↗
Nucleimedium
WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection
CVE-2019-17233—
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
18RISK
open ↗
Nucleicritical
Yachtcontrol Webapplication 1.0 - Remote Command Injection
CVE-2019-17270—
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user vi
30RISK
open ↗
Nucleicritical
Zabbix <=4.4 - Authentication Bypass
CVE-2019-17382—
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass
30RISK
open ↗
Nucleihigh
MetInfo 7.0.0 beta - SQL Injection
CVE-2019-17418—
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchPa
30RISK
open ↗
Nucleicritical
Jfrog Artifactory <6.17.0 - Default Admin Password
CVE-2019-17444CRITICAL
JFrog Artifactory does not enforce default admin password change
55RISK
open ↗
Nucleimedium
Kirona Dynamic Resource Scheduler - Information Disclosure
CVE-2019-17503—
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG
50RISK
open ↗
Nucleicritical
D-Link DIR-868L/817LW - Information Disclosure
CVE-2019-17506—
There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 route
30RISK
open ↗
Nucleihigh
Jiangnan Online Judge 0.8.0 - Local File Inclusion
CVE-2019-17538—
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=
23RISK
open ↗
Nucleihigh
Apache Solr <=8.3.1 - Remote Code Execution
CVE-2019-17558HIGHunder attack
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V
100RISK
open ↗
Nucleicritical
Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization
CVE-2019-17564—
Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST
30RISK
open ↗
Nucleicritical
Popup-Maker < 1.8.12 - Broken Authentication
CVE-2019-17574—
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially
18RISK
open ↗
Nucleicritical
ThinVNC 1.0b1 - Authentication Bypass
CVE-2019-17662—
ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exi
60RISK
open ↗
Nucleicritical
Oracle WebLogic Server Administration Console - Remote Code Execution
CVE-2019-2729CRITICAL
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
Nucleihigh
Oracle Business Intelligence Publisher - XML External Entity Injection
CVE-2019-2767—
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
18RISK
open ↗
Nucleicritical
Atlassian Confluence Server - Path Traversal
CVE-2019-3396CRITICALunder attackransomware
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RISK
open ↗
Nucleihigh
Atlassian Confluence Download Attachments - Remote Code Execution
CVE-2019-3398HIGHunder attack
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at
100RISK
open ↗
Nucleimedium
Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
CVE-2019-3401—
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote
23RISK
open ↗
Nucleimedium
Jira < 8.1.1 - Cross-Site Scripting
CVE-2019-3402—
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows
18RISK
open ↗
Nucleimedium
Jira - Incorrect Authorization
CVE-2019-3403—
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and fr
30RISK
open ↗
Nucleimedium
Spring Cloud Config Server - Local File Inclusion
CVE-2019-3799—
Directory Traversal with spring-cloud-config-server
60RISK
open ↗
Nucleimedium
LabKey Server Community Edition <18.3.0 - Cross-Site Scripting
CVE-2019-3911—
Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an
18RISK
open ↗
Nucleimedium
LabKey Server Community Edition <18.3.0 - Open Redirect
CVE-2019-3912—
An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL param
18RISK
open ↗
Nucleicritical
Barco/AWIND OEM Presentation Platform - Remote Command Injection
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Nucleimedium
IBM BigFix Platform - Information Disclosure
CVE-2019-4061MEDIUM
IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the upd
33RISK
open ↗
Nucleicritical
IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection
CVE-2019-4716CRITICALunder attack
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RISK
open ↗
Nucleicritical
YouPHPTube Encoder 2.3 - Remote Command Injection
CVE-2019-5127CRITICAL
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗
Nucleicritical
YouPHPTube Encoder - Arbitrary File Write
CVE-2019-5128CRITICAL
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗
Nucleicritical
YouPHPTube Encoder 2.3 - Command Injection
CVE-2019-5129CRITICAL
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗
← previouspage 119 / 141next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.