Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
22,786 exploits
Exploit-DB
Kinsey Infor/Lawson / ESBUS - SQL Injection
CVE-2017-6550—10 Mar 2017
Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitra
23RISK
open ↗
Exploit-DB
FTP Voyager Scheduler 16.2.0 - Cross-Site Request Forgery
CVE-2017-6803—10 Mar 2017
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in SolarWinds (formerly
23RISK
open ↗
Exploit-DB
dnaLIMS DNA Sequencing - Directory Traversal / Session Hijacking / Cross-Site Scripting
CVE-2017-6528—10 Mar 2017
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/
23RISK
open ↗
Exploit-DB
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 - Denial of Service
CVE-2017-6552—09 Mar 2017
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 devices have an insufficiently large default value for the maximum IPv6 routing
23RISK
open ↗
Exploit-DB
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
CVE-2017-8223—08 Mar 2017
On Wireless IP Camera (P2P) WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streamin
23RISK
open ↗
Exploit-DB
ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Cross-Site Scripting
CVE-2017-6547—08 Mar 2017
Cross-site scripting (XSS) vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC
23RISK
open ↗
Exploit-DB
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
CVE-2017-8221—08 Mar 2017
Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communicati
23RISK
open ↗
Exploit-DB
ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Remote Code Execution
CVE-2017-6548—08 Mar 2017
Buffer overflows in networkmap on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC
28RISK
open ↗
Exploit-DB
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
CVE-2017-8222—08 Mar 2017
Wireless IP Camera (P2P) WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate st
23RISK
open ↗
Exploit-DB
ASUSWRT RT-AC53 (3.0.0.4.380.6038) - Session Stealing
CVE-2017-6549—08 Mar 2017
Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W
23RISK
open ↗
Exploit-DB
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
CVE-2017-8225—08 Mar 2017
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An
28RISK
open ↗
Exploit-DB
Wireless IP Camera (P2P) WIFICAM - Remote Code Execution
CVE-2017-8224—08 Mar 2017
Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET.
23RISK
open ↗
Exploit-DB
iBall Baton 150M Wireless Router - Authentication Bypass
CVE-2017-6558—07 Mar 2017
iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vuln
28RISK
open ↗
Exploit-DB
Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution
CVE-2017-5638CRITICALunder attackransomware07 Mar 2017
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗
Exploit-DB
Azure Data Expert Ultimate 2.2.16 - Remote Buffer Overflow
CVE-2017-6506—07 Mar 2017
In Azure Data Expert Ultimate 2.2.16, the SMTP verification function suffers from a buffer overflow vulnerability, leadi
28RISK
open ↗
Exploit-DB
Evostream Media Server 1.7.1 (x64) - Denial of Service
CVE-2017-6427—07 Mar 2017
A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A crafted HTTP request with a malicious header will ca
23RISK
open ↗
Exploit-DB
USBPcap 1.1.0.0 (WireShark 2.2.5) - Local Privilege Escalation
CVE-2017-6178—07 Mar 2017
The IofCallDriver function in USBPcap 1.1.0.0 allows local users to gain privileges via a crafted 0x00090028 IOCTL call,
23RISK
open ↗
Exploit-DB
Deluge Web UI 1.3.13 - Cross-Site Request Forgery
CVE-2017-7178—06 Mar 2017
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted p
23RISK
open ↗
Exploit-DB
MikroTik Router - ARP Table OverFlow Denial Of Service
CVE-2017-6444—05 Mar 2017
The MikroTik Router hAP Lite 6.25 has no protection mechanism for unsolicited TCP ACK packets in the case of a fast netw
28RISK
open ↗
Exploit-DB
FTPShell Client 6.53 - Remote Buffer Overflow
CVE-2017-6465—04 Mar 2017
Remote Code Execution was discovered in FTPShell Client 6.53. By default, the client sends a PWD command to the FTP serv
50RISK
open ↗
Exploit-DB
WordPress Core < 4.7.1 - Username Enumeration
CVE-2017-5487—03 Mar 2017
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before
45RISK
open ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002000—03 Mar 2017
Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-
28RISK
open ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002001—03 Mar 2017
Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS so
28RISK
open ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-6104—03 Mar 2017
Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.
23RISK
open ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002003—03 Mar 2017
Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulner
28RISK
open ↗
Exploit-DB
Multiple WordPress Plugins - Arbitrary File Upload
CVE-2017-1002002—03 Mar 2017
Vulnerability in wordpress plugin webapp-builder v2.0, The plugin includes unlicensed vulnerable CMS software from http:
28RISK
open ↗
Exploit-DB
EPSON TMNet WebConfig 1.00 - Cross-Site Scripting
CVE-2017-6443—03 Mar 2017
Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web s
23RISK
open ↗
Exploit-DB
Conext ComBox 865-1058 - Denial of Service
CVE-2017-6019—02 Mar 2017
An issue was discovered in Schneider Electric Conext ComBox, model 865-1058, all firmware versions prior to V3.03 BN 830
35RISK
open ↗
Exploit-DB
Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting
CVE-2016-8527—01 Mar 2017
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). Th
43RISK
open ↗
Exploit-DB
Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting
CVE-2016-8526—01 Mar 2017
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a
23RISK
open ↗
← previouspage 145 / 760next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.