Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
phpLiteAdmin 1.1 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in phpLiteAdmin 1.1 allows remote attackers to hijack the authentication
23RISK
open ↗Exploit-DB
INFOMARK IMW-C920W MiniUPnPd 1.0 - Denial of Service
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attacke
60RISK
open ↗Exploit-DB
PHPXMLRPC < 1.1 - Remote Code Execution
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PH
60RISK
open ↗Exploit-DB
Watchguard XCS 10.0 - Multiple Vulnerabilities
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
23RISK
open ↗Exploit-DB
Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors re
23RISK
open ↗Exploit-DB
Novius 5.0.1 - Multiple Vulnerabilities
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
43RISK
open ↗Exploit-DB
Novius 5.0.1 - Multiple Vulnerabilities
Directory traversal vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to include and execute arbitrary lo
23RISK
open ↗Exploit-DB
C2Box 4.0.0(r19171) - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box befor
23RISK
open ↗Exploit-DB
Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain p
23RISK
open ↗Exploit-DB
Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows attackers to obtain sensitive information and potenti
23RISK
open ↗Exploit-DB
Fiyo CMS 2.0_1.9.1 - SQL Injection
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands vi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - Drawing Fill Shader Memory Corruption (Metasploit)
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
60RISK
open ↗Exploit-DB
Watchguard XCS 10.0 - Multiple Vulnerabilities
The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-
23RISK
open ↗Exploit-DB
Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities
Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation
23RISK
open ↗Exploit-DB
Polycom RealPresence Resource Manager < 8.4 - Multiple Vulnerabilities
Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) re
23RISK
open ↗Exploit-DB
Endian Firewall < 3.0.0 - OS Command Injection
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW
50RISK
open ↗Exploit-DB
XOOPS < 2.0.11 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitra
23RISK
open ↗Exploit-DB
DeDeCMS < 5.7-sp1 - Remote File Inclusion
A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
35RISK
open ↗Exploit-DB
Endian Firewall < 3.0.0 - OS Command Injection (Metasploit)
Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW
50RISK
open ↗Exploit-DB
XOOPS < 2.0.11 - Multiple Vulnerabilities
SQL injection vulnerability in the loginUser function in the XMLRPC server in XOOPS 2.0.11 and earlier allows remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
Havij - OLE Automation Array Remote Code Execution
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗Exploit-DB
ManageEngine Asset Explorer 6.1 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attacker
23RISK
open ↗Exploit-DB
Thycotic Secret Server 8.8.000004 - Persistent Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before
23RISK
open ↗Exploit-DB
Koha 3.20.1 - Directory Traversal
Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08
50RISK
open ↗Exploit-DB
Koha 3.20.1 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and
23RISK
open ↗Exploit-DB
Koha 3.20.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before
23RISK
open ↗Exploit-DB
Koha 3.20.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x
23RISK
open ↗Exploit-DB
GeniXCMS 0.0.3 - 'register.php' SQL Injection
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote
23RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows - ClientCopyImage Win32k (MS15-051) (Metasploit)
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local
98RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - ShaderJob Buffer Overflow (Metasploit)
Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.