Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,186cataloged exploits
40,156CVEs with public exploitation
24,696lab-tested
AllReferência 26,041Exploit-DB 24,488GitHub PoC 17,609VulnCheck XDB 9,976Nuclei 4,542Metasploit 3,530✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Joomla! Component Huge-IT Video Gallery 1.0.9 - SQL Injection
CVE-2016-1000123—webappsphp31 Aug 2017
Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Git < 2.7.5 - Command Injection (Metasploit)
CVE-2017-1000117—remotepython31 Aug 2017
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
60RISK
open ↗
Exploit-DB
IBM Notes 8.5.x/9.0.x - Denial of Service (Metasploit)
CVE-2017-1129—dosmultiple31 Aug 2017
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it coul
50RISK
open ↗
Exploit-DB
Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.7 - SQL Injection
CVE-2016-1000125—webappsphp31 Aug 2017
Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
23RISK
open ↗
Exploit-DB
Joomla! Component Huge-IT Portfolio Gallery Plugin 1.0.6 - SQL Injection
CVE-2016-1000124—webappsphp31 Aug 2017
Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Metasploit Web UI < 4.14.1-20170828 - Cross-Site Request Forgery
CVE-2017-15084—webappsruby30 Aug 2017
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22.
23RISK
open ↗
Exploit-DB
Oracle Java JDK/JRE < 1.8.0.131 / Apache Xerces 2.11.0 - 'PDF/Docx' Server Side Denial of Service
CVE-2017-10355—dosphp30 Aug 2017
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supporte
28RISK
open ↗
Exploit-DB
D-Link DIR-600 - Authentication Bypass
CVE-2017-12943—webappshardware29 Aug 2017
D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?RE
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6997—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6994—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6996—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6979—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6989—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6999—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6995—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Apple iOS < 10.3.1 - Kernel
CVE-2017-6998—localios26 Aug 2017
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchO
23RISK
open ↗
Exploit-DB
libgig 4.0.0 (LinuxSampler) - Multiple Vulnerabilities
CVE-2017-12953—doslinux23 Aug 2017
The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial
23RISK
open ↗
Exploit-DB
libgig 4.0.0 (LinuxSampler) - Multiple Vulnerabilities
CVE-2017-12951—doslinux23 Aug 2017
The gig::DimensionRegion::CreateVelocityTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a den
23RISK
open ↗
Exploit-DB
libgig 4.0.0 (LinuxSampler) - Multiple Vulnerabilities
CVE-2017-12950—doslinux23 Aug 2017
The gig::Region::Region function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL p
23RISK
open ↗
Exploit-DB
Wireless Repeater BE126 - Local File Inclusion
CVE-2017-8770—webappshardware23 Aug 2017
There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesys
28RISK
open ↗
Exploit-DB
libgig 4.0.0 (LinuxSampler) - Multiple Vulnerabilities
CVE-2017-12954—doslinux23 Aug 2017
The gig::Region::GetSampleFromWavePool function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of
23RISK
open ↗
Exploit-DB
libgig 4.0.0 (LinuxSampler) - Multiple Vulnerabilities
CVE-2017-12952—doslinux23 Aug 2017
The LoadString function in helper.h in libgig 4.0.0 allows remote attackers to cause a denial of service (NULL pointer d
23RISK
open ↗
Exploit-DB✓ VexDay Proof
IBM OpenAdmin Tool - SOAP welcomeServer PHP Code Execution (Metasploit)
CVE-2017-1092—remotephp22 Aug 2017
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system a
60RISK
open ↗
Exploit-DB
Automated Logic WebCTRL 6.1 - Path Traversal / Arbitrary File Write
CVE-2017-9640—webappsjava22 Aug 2017
A Path Traversal issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web prior to 6.5;
23RISK
open ↗
Exploit-DB
Automated Logic WebCTRL 6.5 - Local Privilege Escalation
CVE-2017-9644—localwindows22 Aug 2017
An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan
23RISK
open ↗
Exploit-DB
Automated Logic WebCTRL 6.5 - Unrestricted File Upload / Remote Code Execution
CVE-2017-9650—webappsjava22 Aug 2017
An Unrestricted Upload of File with Dangerous Type issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL
23RISK
open ↗
Exploit-DB
PDF-XChange Viewer 2.5 Build 314.0 - Code Execution
CVE-2017-13056—localwindows21 Aug 2017
The launchURL function in PDF-XChange Viewer 2.5 (Build 314.0) might allow remote attackers to execute arbitrary code vi
23RISK
open ↗
Exploit-DB
Apache2Triad 1.5.4 - Multiple Vulnerabilities
CVE-2017-12965—webappsphp21 Aug 2017
Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID pa
28RISK
open ↗
Exploit-DB
Apache2Triad 1.5.4 - Multiple Vulnerabilities
CVE-2017-12971—webappsphp21 Aug 2017
Cross-site scripting (XSS) vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script or
23RISK
open ↗
Exploit-DB
PHPMyWind 5.3 - Cross-Site Scripting
CVE-2017-12984—webappsphp21 Aug 2017
PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.
23RISK
open ↗
← previouspage 132 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.