Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
Trend Micro OfficeScan 11.0/XG (12.0) - Information Disclosure
CVE-2017-14085—webappsphp28 Sep 2017
Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can acc
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Trend Micro OfficeScan 11.0/XG (12.0) - Private Key Disclosure
CVE-2017-14083—webappsphp28 Sep 2017
A vulnerability in Trend Micro OfficeScan 11.0 and XG allows remote unauthenticated users who can access the system to d
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Trend Micro OfficeScan 11.0/XG (12.0) - Code Execution / Memory Corruption
CVE-2017-14086—webappswindows28 Sep 2017
Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated u
23RISK
open ↗
Exploit-DB
Cisco Prime Collaboration Provisioning < 12.1 - Authentication Bypass / Remote Code Execution
CVE-2017-6622—remotehardware27 Sep 2017
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote a
35RISK
open ↗
Exploit-DB
LAquis SCADA 4.1.0.2385 - Directory Traversal (Metasploit)
CVE-2017-6020—remotemultiple27 Sep 2017
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237
23RISK
open ↗
Exploit-DB
SmarterStats 11.3.6347 - Cross-Site Scripting
CVE-2017-14620—webappsaspx27 Sep 2017
SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQu
23RISK
open ↗
Exploit-DB
Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution
CVE-2015-4852CRITICALunder attackremotejava27 Sep 2017
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
100RISK
open ↗
Exploit-DB
Linux Kernel 3.10.0-514.21.2.el7.x86_64 / 3.10.0-514.26.1.el7.x86_64 (CentOS 7) - SUID Position Independent Executable 'PIE' Local Privilege Escalation
CVE-2017-1000253HIGHunder attackransomwarelocallinux26 Sep 2017
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb7
76RISK
open ↗
Exploit-DB
WordPress Plugin WPAMS - SQL Injection
CVE-2017-14847—webappsphp26 Sep 2017
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Exploit-DB
SMSmaster - SQL Injection
CVE-2017-14842—webappsphp26 Sep 2017
Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Exploit-DB
WordPress Plugin WPGYM - SQL Injection
CVE-2017-14844—webappsphp26 Sep 2017
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
23RISK
open ↗
Exploit-DB
AMC Master - Arbitrary File Upload
CVE-2017-14841—webappsphp26 Sep 2017
Mojoomla Annual Maintenance Contract (AMC) Management System allows Arbitrary File Upload in profilesetting image handli
23RISK
open ↗
Exploit-DB
Job Links - Arbitrary File Upload
CVE-2017-14838—webappsphp26 Sep 2017
TeamWork Job Links allows Arbitrary File Upload in profileChange and coverChange.
23RISK
open ↗
Exploit-DB
WordPress Plugin School Management System - SQL Injection
CVE-2017-14843—webappsphp26 Sep 2017
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Exploit-DB
TicketPlus - Arbitrary File Upload
CVE-2017-14840—webappsphp26 Sep 2017
TeamWork TicketPlus allows Arbitrary File Upload in updateProfile.
23RISK
open ↗
Exploit-DB
WordPress Plugin WPCHURCH - SQL Injection
CVE-2017-14845—webappsphp26 Sep 2017
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Exploit-DB
Photo Fusion - Arbitrary File Upload
CVE-2017-14839—webappsphp26 Sep 2017
TeamWork Photo Fusion allows Arbitrary File Upload in changeAvatar and changeCover.
23RISK
open ↗
Exploit-DB
WordPress Plugin Hospital Management System - SQL Injection
CVE-2017-14846—webappsphp26 Sep 2017
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Supervisor 3.0a1 < 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit)
CVE-2017-11610—remotelinux25 Sep 2017
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows rem
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Out-of-Bounds Write in MP4 Edge Processing
CVE-2017-11281—dosmultiple25 Sep 2017
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploita
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Out-of-Bounds Memory Read in MP4 Parsing
CVE-2017-11281—dosmultiple25 Sep 2017
Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploita
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - Out-of-Bounds Read in applyToRange
CVE-2017-11282—dosmultiple25 Sep 2017
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation co
35RISK
open ↗
Exploit-DB
Oracle 9i XDB 9.2.0.1 - HTTP PASS Buffer Overflow
CVE-2003-0727—remotewindows25 Sep 2017
Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS 10.2 - Broadcom Out-of-Bounds Write when Handling 802.11k Neighbor Report Response
CVE-2017-11120—remoteios25 Sep 2017
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
CyberLink LabelPrint < 2.5 - Local Buffer Overflow (SEH Unicode)
CVE-2017-14627—localwindows23 Sep 2017
Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) au
43RISK
open ↗
Exploit-DB
Claydip Airbnb Clone 1.0 - Arbitrary File Upload
CVE-2017-14704—webappsphp22 Sep 2017
Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Larav
23RISK
open ↗
Exploit-DB
Cash Back Comparison Script 1.0 - SQL Injection
CVE-2017-14703—webappsphp22 Sep 2017
SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge - Chakra Incorrectly Parses Object Patterns
CVE-2017-8729—doswindows21 Sep 2017
Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current u
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'JavascriptFunction::ReparseAsmJsModule' Incorrectly Re-parses
CVE-2017-8755—doswindows21 Sep 2017
Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'Parser::ParseCatch' Does Not Handle 'eval()' (Denial of Service)
CVE-2017-11764—doswindows21 Sep 2017
Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code
35RISK
open ↗
← previouspage 129 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.