Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,432cataloged exploits
34,424CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,493GitHub PoC 13,618VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
8,198 exploits
VulnCheck XDB
initial-access
CVE-2022-29464CRITICALunder attackransomware22 Sep 2022
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2015-8562—21 Sep 2022
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-36804HIGHunder attack21 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-44228CRITICALunder attackransomware21 Sep 2022
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-36804HIGHunder attack20 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2022-36804HIGHunder attack20 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware20 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-36804HIGHunder attack19 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
VulnCheck XDB
local
CVE-2017-12149CRITICALunder attackransomware19 Sep 2022
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-31814CRITICAL18 Sep 2022
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-27925HIGHunder attackransomware17 Sep 2022
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2022-30190HIGHunder attackransomware15 Sep 2022
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2021-42013CRITICALunder attackransomware15 Sep 2022
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2021-42013CRITICALunder attackransomware15 Sep 2022
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-0193HIGHunder attack13 Sep 2022
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-27925HIGHunder attackransomware12 Sep 2022
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file
100RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2022-30075—12 Sep 2022
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote
35RISK
open ↗
VulnCheck XDB
local
CVE-2022-0847HIGHunder attack11 Sep 2022
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2021-38163CRITICALunder attack10 Sep 2022
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated
90RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2016-5734—10 Sep 2022
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-1000486CRITICALunder attack09 Sep 2022
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2014-6271CRITICALunder attack09 Sep 2022
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-36804HIGHunder attack07 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
← previouspage 181 / 274next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.