Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,980cataloged exploits
36,899CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,476Referência 23,400GitHub PoC 15,250VulnCheck XDB 8,959Nuclei 4,393Metasploit 3,502✓ verified onlyrecentpopularrisk
24,476 exploits
Exploit-DB✓ VexDay Proof
FS Shutterstock Clone 1.0 - 'keywords' SQL Injection
CVE-2017-17583—webappsphp08 Dec 2017
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
23RISK
open ↗
Exploit-DB
Doctor Search Script 1.0 - 'city' SQL Injection
CVE-2017-17611—webappsphp08 Dec 2017
Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Makemytrip Clone 1.0 - 'fl_orig' / 'fl_dest' SQL Injection
CVE-2017-17584—webappsphp08 Dec 2017
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Monster Clone 1.0 - 'Employer_Details.php?id' SQL Injection
CVE-2017-17585—webappsphp08 Dec 2017
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Simple Chatting System 1.0.0 - Arbitrary File Upload
CVE-2017-17593—webappsphp08 Dec 2017
Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.
23RISK
open ↗
Exploit-DB
Co-work Space Search Script 1.0 - 'city' SQL Injection
CVE-2017-17606—webappsphp08 Dec 2017
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
FS Quibids Clone 1.0 - SQL Injection
CVE-2017-17581—webappsphp08 Dec 2017
FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Website Auction Marketplace 2.0.5 - 'cat_id' SQL Injection
CVE-2017-17592—webappsphp08 Dec 2017
Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
23RISK
open ↗
Exploit-DB
Chartered Accountant Booking Script 1.0 - 'city' SQL Injection
CVE-2017-17609—webappsphp08 Dec 2017
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
23RISK
open ↗
Exploit-DB
E-commerce MLM Software 1.0 - SQL Injection
CVE-2017-17610—webappsphp08 Dec 2017
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid paramet
23RISK
open ↗
Exploit-DB
Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal
CVE-2017-16930—remotewindows07 Dec 2017
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute
35RISK
open ↗
Exploit-DB
Apple macOS High Sierra 10.13 - 'ctl_ctloutput-leak' Information Leak
CVE-2017-13868—localmacos07 Dec 2017
An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS b
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux Kernel 4.10.5 / < 4.14.3 (Ubuntu) - DCCP Socket Use-After-Free
CVE-2017-8824—doslinux07 Dec 2017
The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privilege
23RISK
open ↗
Exploit-DB
Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal
CVE-2017-16929—remotewindows07 Dec 2017
The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversa
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Wireshark 2.4.0 < 2.4.2 / 2.2.0 < 2.2.10 - CIP Safety Dissector Crash
CVE-2017-17085—dosmultiple07 Dec 2017
In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. This was addressed in epan/dissec
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 4.0.23 - Local Privilege Escalation
CVE-2017-11741—localmacos06 Dec 2017
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo help
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Arq 5.9.7 - Local Privilege Escalation
CVE-2017-16895—localmacos06 Dec 2017
The (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) arqglacierrestorer, and (5) arqs3glacierrestorer helper
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.1 - Local Privilege Escalation
CVE-2017-16001—localmacos06 Dec 2017
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently su
23RISK
open ↗
Exploit-DB
Sera 1.2 - Local Privilege Escalation / Password Disclosure
CVE-2017-15918—localmacos06 Dec 2017
Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.0 - Local Privilege Escalation
CVE-2017-15884—localmacos06 Dec 2017
In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently su
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Arq 5.9.6 - Local Privilege Escalation
CVE-2017-15357—localmacos06 Dec 2017
The setpermissions function in the auto-updater in Arq before 5.9.7 for Mac allows local users to gain root privileges v
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 5.0.3 - Local Privilege Escalation
CVE-2017-16777—localmacos06 Dec 2017
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a loc
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Hashicorp vagrant-vmware-fusion 4.0.24 - Local Privilege Escalation
CVE-2017-12579—localmacos06 Dec 2017
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and ear
23RISK
open ↗
Exploit-DB
Proxifier for Mac 2.19 - Local Privilege Escalation
CVE-2017-7690—localmacos06 Dec 2017
Proxifier for Mac before 2.19.2, when first run, allows local users to gain privileges by replacing the KLoader binary w
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Techno Portfolio Management Panel - 'id' SQL Injection
CVE-2017-17110—webappsphp05 Dec 2017
Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Perspective ICM Investigation & Case 5.1.1.16 - Privilege Escalation
CVE-2017-11319—webappswindows05 Dec 2017
Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Readymade Classifieds Script 1.0 - SQL Injection
CVE-2017-17111—webappsphp05 Dec 2017
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
23RISK
open ↗
Exploit-DB
Ruby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection
CVE-2017-17405—localruby02 Dec 2017
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and p
45RISK
open ↗
Exploit-DB
Artica Web Proxy 3.06 - Remote Code Execution
CVE-2017-17055—webappsphp01 Dec 2017
Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site
23RISK
open ↗
Exploit-DB✓ VexDay Proof
MistServer 2.12 - Cross-Site Scripting
CVE-2017-16884—webappsmultiple01 Dec 2017
Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web scrip
23RISK
open ↗
← previouspage 121 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.