Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB
WordPress Plugin Simple Ads Manager - Information Disclosure
WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
28RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input i
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebGate eDVR Manager 2.6.4 - Connect Method Stack Buffer Overflow
Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c
28RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB
WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload
Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPres
28RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB
Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal
Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5
43RISK
open ↗Exploit-DB✓ VexDay Proof
Ceragon FibeAir IP-10 - SSH Private Key Exposure (Metasploit)
Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remot
60RISK
open ↗Exploit-DB
Airties Air5650TT - Remote Stack Overflow
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 502
60RISK
open ↗Exploit-DB
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup fil
28RISK
open ↗Exploit-DB
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update"
28RISK
open ↗Exploit-DB
Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks
23RISK
open ↗Exploit-DB
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authe
23RISK
open ↗Exploit-DB✓ VexDay Proof
Adobe Flash Player - ByteArray With Workers Use-After-Free (Metasploit)
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
100RISK
open ↗Exploit-DB
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via
23RISK
open ↗Exploit-DB
WordPress Plugin Slider REvolution 4.1.4 - Arbitrary File Download
Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote att
28RISK
open ↗Exploit-DB
Fedora 21 setroubleshootd 3.2.22 - Local Privilege Escalation
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to ex
28RISK
open ↗Exploit-DB
WordPress Plugin Slider REvolution 4.1.4 - Arbitrary File Download
Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitra
43RISK
open ↗Exploit-DB
Joomla! Component Contact Form Maker 1.0.1 - SQL Injection
SQL injection vulnerability in Joomla! Component Contact Form Maker 1.0.1 allows remote attackers to execute arbitrary S
23RISK
open ↗Exploit-DB
Berta CMS - Arbitrary File Upload
Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a cra
28RISK
open ↗Exploit-DB✓ VexDay Proof
Acunetix 9.5 - OLE Automation Array Remote Code Execution
OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows
100RISK
open ↗Exploit-DB
WebGate eDVR Manager 2.6.4 - SiteName Stack Overflow
Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspe
28RISK
open ↗Exploit-DB
WebGate WinRDS 2.0.8 - StopSiteAllChannel Stack Overflow
Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to
28RISK
open ↗Exploit-DB
WebGate Control Center 4.8.7 - GetThumbnail Stack Overflow
Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vec
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.