Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,679cataloged exploits
40,329CVEs with public exploitation
24,696lab-tested
AllReferência 26,150Exploit-DB 24,488GitHub PoC 17,946VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Linux Kernel 3.13/3.14 (Ubuntu) - 'splice()' System Call Local Denial of Service
The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restrictio
23RISK
open ↗Exploit-DB✓ VexDay Proof
Lenovo System Update - Local Privilege Escalation (Metasploit)
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allo
38RISK
open ↗Exploit-DB✓ VexDay Proof
Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and o
86RISK
open ↗Exploit-DB✓ VexDay Proof
SolarWinds Firewall Security Manager 6.6.5 - Client Session Handling (Metasploit)
userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privile
60RISK
open ↗Exploit-DB
WordPress Plugin Shareaholic 7.6.0.3 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Novell ZENworks Configuration Management 11.3.1 - Remote Code Execution
Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11
60RISK
open ↗Exploit-DB✓ VexDay Proof
JBoss Seam 2 - Arbitrary File Upload / Execution (Metasploit)
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly
100RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Simple Ads Manager - Multiple SQL Injections
Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attacke
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebGate eDVR Manager 2.6.4 - AudioOnlySiteChannel Stack Buffer Overflow
Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspe
28RISK
open ↗Exploit-DB
WebGate WinRDS 2.0.8 - PlaySiteAllChannel Stack Buffer Overflow
Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to
28RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
Multiple unspecified vulnerabilities in Google Chrome before 39.0.2171.65 allow attackers to cause a denial of service o
23RISK
open ↗Exploit-DB
WebGate WESP SDK 1.2 - ChangePassword Stack Overflow
Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c
28RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
100RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
A CSRF Vulnerability exists in Kemp Load Master before 7.0-18a via unspecified vectors in administrative pages.
23RISK
open ↗Exploit-DB
Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal
Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5
43RISK
open ↗Exploit-DB
WordPress Plugin Simple Ads Manager - Information Disclosure
WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
28RISK
open ↗Exploit-DB
WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload
Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPres
28RISK
open ↗Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input i
23RISK
open ↗Exploit-DB✓ VexDay Proof
WebGate eDVR Manager 2.6.4 - SiteChannel Property Stack Buffer Overflow
Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspe
28RISK
open ↗Exploit-DB✓ VexDay Proof
WebGate eDVR Manager 2.6.4 - Connect Method Stack Buffer Overflow
Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary c
28RISK
open ↗Exploit-DB✓ VexDay Proof
Ceragon FibeAir IP-10 - SSH Private Key Exposure (Metasploit)
Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remot
60RISK
open ↗Exploit-DB
Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks
23RISK
open ↗Exploit-DB
Fiyo CMS 2.0.1.8 - Multiple Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web s
23RISK
open ↗Exploit-DB
Airties Air5650TT - Remote Stack Overflow
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 502
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.