Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,589cataloged exploits
34,508CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,554GitHub PoC 13,689VulnCheck XDB 8,216Nuclei 4,223Metasploit 3,464✓ verified onlyrecentpopularrisk
24,443 exploits
Exploit-DB✓ VexDay Proof
Linux Kernel 3.2.0-23/3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2 x64) - 'perf_swevent_init' Local Privilege Escalation (3)
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t
83RISK
open ↗Exploit-DB✓ VexDay Proof
ElasticSearch Dynamic Script - Arbitrary Java Execution (Metasploit)
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RISK
open ↗Exploit-DB✓ VexDay Proof
Huawei E303 Router - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Tera Charts (tera-charts) - '/charts/zoomabletreemap.php?fn' Directory Traversal
Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attacker
43RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Tera Charts (tera-charts) - '/charts/treemap.php?fn' Directory Traversal
Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attacker
43RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin WP Rss Poster - '/wp-admin/admin.php' SQL Injection
SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to e
23RISK
open ↗Exploit-DB✓ VexDay Proof
webEdition CMS - 'we_fs.php' SQL Injection
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and
23RISK
open ↗Exploit-DB✓ VexDay Proof
AuraCMS 3.0 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in filemanager.php in AuraCMS 3.0 and earlier allows remote attackers to inject
23RISK
open ↗Exploit-DB✓ VexDay Proof
AuraCMS 3.0 - Multiple Vulnerabilities
Absolute path traversal vulnerability in filemanager.php in AuraCMS 3.0 allows remote attackers to list a directory via
23RISK
open ↗Exploit-DB
Sharetronix 3.3 - Multiple Vulnerabilities
Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authenti
23RISK
open ↗Exploit-DB
Sharetronix 3.3 - Multiple Vulnerabilities
SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL command
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux Kernel 3.3.5 - '/drivers/media/media-device.c' Local Information Disclosure
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initi
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin HDW Player - '/wp-admin/admin.php' SQL Injection
SQL injection vulnerability in the videos page in the HDW Player Plugin (hdw-player-video-player-video-gallery) 2.4.2 fo
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin ENL NewsLetter - '/wp-admin/admin.php' SQL Injection
SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticate
23RISK
open ↗Exploit-DB✓ VexDay Proof
Wireshark CAPWAP Dissector - Denial of Service (Metasploit)
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
50RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin BookX 1.7 - 'bookx_export.php' Local File Inclusion
Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to
23RISK
open ↗Exploit-DB
TORQUE Resource Manager 2.5.x < 2.5.13 - Stack Buffer Overflow Stub
Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Reso
28RISK
open ↗Exploit-DB✓ VexDay Proof
Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow
Stack-based buffer overflow in EFS Software Easy File Sharing FTP Server 2.0 allows remote attackers to execute arbitrar
50RISK
open ↗Exploit-DB✓ VexDay Proof
Castor Library - XML External Entity Information Disclosure
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct
23RISK
open ↗Exploit-DB✓ VexDay Proof
Videos Tube 1.0 - Multiple SQL Injections
Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via t
23RISK
open ↗Exploit-DB
Linux Kernel 3.14-rc1 < 3.15-rc4 (x64) - Raw Mode PTY Echo Race Condition Privilege Escalation
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
68RISK
open ↗Exploit-DB✓ VexDay Proof
Symantec Workspace Streaming - Arbitrary File Upload (Metasploit)
The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functional
50RISK
open ↗Exploit-DB
ZYXEL P-660HW-T1 3 Wireless Router - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in the Zyxel P-660HW-T1 (v3) wireless router allow remote att
23RISK
open ↗Exploit-DB✓ VexDay Proof
dpkg Source Package - Index: pseudo-header Processing Multiple Local Directory Traversals
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files out
23RISK
open ↗Exploit-DB✓ VexDay Proof
User Cake - Cross-Site Request Forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in user_settings.php in Usercake 2.0.2 and earlier allow remo
23RISK
open ↗Exploit-DB✓ VexDay Proof
Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.1
23RISK
open ↗Exploit-DB✓ VexDay Proof
PHP-Nuke 'Submit_News' Component - SQL Injection
SQL injection vulnerability in the Submit_News module for PHP-Nuke 8.3 allows remote attackers to execute arbitrary SQL
23RISK
open ↗Exploit-DB✓ VexDay Proof
Pyplate - 'addScript.py' Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in admin/addScript.py in Pyplate 0.08 allows remote attackers to hijack
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache mod_wsgi - Information Disclosure
mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive info
23RISK
open ↗Exploit-DB✓ VexDay Proof
WordPress Plugin Booking System (Booking Calendar) - 'booking_form_id' SQL Injection
SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for Wo
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.