Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,388cataloged exploits
40,212CVEs with public exploitation
24,696lab-tested
AllReferência 26,070Exploit-DB 24,488GitHub PoC 17,762VulnCheck XDB 9,990Nuclei 4,547Metasploit 3,531✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Subsonic 6.1.1 - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target u
23RISK
open ↗Exploit-DB
WordPress Plugin Event List < 0.7.8 - SQL Injection
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitra
23RISK
open ↗Exploit-DB
WordPress Plugin WP-Testimonials < 3.4.1 - SQL Injection
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute ar
23RISK
open ↗Exploit-DB
Sungard eTRAKiT3 <= 3.2.1.17 - SQL Injection
The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run a subset of SQL commands against the back-end database
28RISK
open ↗Exploit-DB
HPE Intelligent Management Center (iMC) 7.2 (E0403P10) - Code Execution
A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
35RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit JSC - 'JSObject::ensureLength' ensureLengthSlow Check Failure
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - CachedFrame does not Detach Openers Universal Cross-Site Scripting
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit JSC - Incorrect Check in emitPutDerivedConstructorToArrowFunctionContextScope
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
IBM Informix Dynamic Server / Informix Open Admin Tool - DLL Injection / Remote Code Execution / Heap Buffer Overflow
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system a
60RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MsMpEng - Use-After-Free via Saved Callers
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
35RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
93RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MsMpEng - Multiple Crashes While Scanning Malformed Files
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MsMpEng - Multiple Crashes While Scanning Malformed Files
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
28RISK
open ↗Exploit-DB✓ VexDay Proof
Samba 3.5.0 < 4.4.14/4.5.10/4.6.4 - 'is_known_pipename()' Arbitrary Module Load (Metasploit)
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MsMpEng - Multiple Crashes While Scanning Malformed Files
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft MsMpEng - Multiple Crashes While Scanning Malformed Files
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Serve
35RISK
open ↗Exploit-DB✓ VexDay Proof
Apple WebKit / Safari 10.0.3(12602.4.8) - 'WebCore::FrameView::scheduleRelayout' Use-After-Free
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox < 53 - 'ConvolvePixel' Memory Disclosure
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for other
28RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - 'ContainerNode::parserInsertBefore' Universal Cross-Site Scripting
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - 'FrameLoader::clear' Stealing Variables via Page Navigation
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebKit - 'enqueuePageshowEvent' / 'enqueuePopstateEvent' Universal Cross-Site Scripting
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mozilla Firefox < 53 - 'gfxTextRun' Out-of-Bounds Read
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitabl
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apple WebKit / Safari 10.0.3(12602.4.8) - 'Editor::Command::execute' Universal Cross-Site Scripting
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS
23RISK
open ↗Exploit-DB
Sophos Cyberoam - Cross-site scripting
An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Soph
23RISK
open ↗Exploit-DB✓ VexDay Proof
Samba 3.5.0 - Remote Code Execution
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISK
open ↗Exploit-DB✓ VexDay Proof
Apple macOS/iOS - 'CAMediaTimingFunctionBuiltin' NSKeyedArchiver Memory Corruption Due to Lack of Bounds Checking
An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "CoreAnimati
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple macOS/iOS - NSUnarchiver Heap Corruption Due to Lack of Bounds Checking in [NSBuiltinCharacterSet initWithCoder:]
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS
28RISK
open ↗Exploit-DB✓ VexDay Proof
Apple macOS/iOS - Memory Corruption Due to Bad Bounds Checking in NSCharacterSet Coding for NSKeyedUnarchiver
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple macOS/iOS - 'TIKeyboardLayout initWithCoder:' NSKeyedArchiver Heap Corruption Due to Rounding Error
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apple macOS/iOS Kernel - Use-After-Free Due to Bad Locking in Unix Domain Socket File Descriptor Externalization
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.