Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::SimpleLineLayout::RunResolver::runForPoint' Out-of-Bounds Read
CVE-2017-13784—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB
KMPlayer 4.2.2.4 - Denial of Service
CVE-2017-16952—doswindows22 Nov 2017
KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service via a crafted NSV file.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::FormSubmission::create' Use-After-Free
CVE-2017-13791—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::SVGPatternElement::collectPatternAttributes' Out-of-Bounds Read
CVE-2017-13783—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::AXObjectCache::performDeferredCacheUpdate' Use-After-Free
CVE-2017-13795—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::Style::TreeResolver::styleForElement' Use-After-Free
CVE-2017-13802—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::InputType::element' Use-After-Free (2)
CVE-2017-13792—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB
Winamp Pro 5.66.Build.3512 - Denial of Service
CVE-2017-16951—doswindows22 Nov 2017
Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial of service via a crafted WAV, WMV, AU, ASF, AIFF, o
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::TreeScope::documentScope' Use-After-Free
CVE-2017-13796—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::DocumentLoader::frameLoader' Use-After-Free
CVE-2017-13794—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WebKit - 'WebCore::PositionIterator::decrement' Use-After-Free
CVE-2017-13797—dosmultiple22 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - 'nt!NtQueryDirectoryFile (luafv!LuafvCopyDirectoryEntry)' Pool Memory Disclosure
CVE-2017-11831—doswindows21 Nov 2017
Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2,
23RISK
open ↗
Exploit-DB
DblTek - Multiple Vulnerabilities
CVE-2017-16934—webappslinux21 Nov 2017
The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin pas
28RISK
open ↗
Exploit-DB
Vonage VDV-23 - Denial of Service
CVE-2017-16902—doshardware21 Nov 2017
On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or logi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - CiSetFileCache TOCTOU Security Feature Bypass
CVE-2017-11830—localwindows20 Nov 2017
Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allow
23RISK
open ↗
Exploit-DB✓ VexDay Proof
iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service
CVE-2017-13849—dosios20 Nov 2017
An issue was discovered in certain Apple products. iOS before 11.1 is affected. tvOS before 11.1 is affected. watchOS be
23RISK
open ↗
Exploit-DB
Microsoft Office - OLE Remote Code Execution
CVE-2017-11882HIGHunder attackransomwareremotewindows20 Nov 2017
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi
100RISK
open ↗
Exploit-DB
Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting
CVE-2017-16819—webappshardware17 Nov 2017
A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows re
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge - 'Object.setPrototypeOf' Memory Corruption
CVE-2017-8751—doswindows16 Nov 2017
Microsoft Edge in Microsoft Windows 1703 allows an attacker to execute arbitrary code in the context of the current user
35RISK
open ↗
Exploit-DB
Vonage VDV23 - Cross-Site Scripting
CVE-2017-16843—webappshardware16 Nov 2017
Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra: JIT - 'Lowerer::LowerBoundCheck' Incorrect Integer Overflow Check
CVE-2017-11861—doswindows16 Nov 2017
Microsoft Edge in Windows 10 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker t
35RISK
open ↗
Exploit-DB
LanSweeper 6.0.100.75 - Cross-Site Scripting
CVE-2017-16841—webappsaspx16 Nov 2017
LanSweeper 6.0.100.75 has XSS via the description parameter to /Calendar/CalendarActions.aspx.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra: JIT - 'OP_Memset' Type Confusion
CVE-2017-11873—doswindows16 Nov 2017
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Zeta Components Mail 1.8.1 - Remote Code Execution
CVE-2017-15806—webappsphp16 Nov 2017
The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the s
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra JIT - Type Confusion with switch Statements
CVE-2017-11811—doswindows16 Nov 2017
ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker
35RISK
open ↗
Exploit-DB
CommuniGatePro 6.1.16 - Cross-Site Scripting
CVE-2017-16962—webappsmultiple15 Nov 2017
The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities vi
23RISK
open ↗
Exploit-DB✓ VexDay Proof
D-Link DIR-605L < 2.08 - Denial of Service
CVE-2017-9675—doshardware14 Nov 2017
On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.
28RISK
open ↗
Exploit-DB
PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free
CVE-2017-15270—doswindows14 Nov 2017
The PSFTPd 10.0.4 Build 729 server does not properly escape data before writing it into a Comma Separated Values (CSV) f
23RISK
open ↗
Exploit-DB
PSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free
CVE-2017-15271—doswindows14 Nov 2017
A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. This issue could be
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Kirby CMS < 2.5.7 - Cross-Site Scripting
CVE-2017-16807—webappsphp13 Nov 2017
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exist
23RISK
open ↗
← previouspage 123 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.