Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,989cataloged exploits
40,450CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,042VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
10,121 exploits
VulnCheck XDB
infoleak
CVE-2020-17519CRITICALunder attack13 Apr 2021
Apache Flink directory traversal attack: reading remote files through the REST API
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2020-5902CRITICALunder attackransomware13 Apr 2021
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2003-0201—12 Apr 2021
Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x vers
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975CRITICALunder attackransomware10 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack09 Apr 2021
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21402HIGH09 Apr 2021
Unauthenticated Arbitrary File Access in Jellyfin
78RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-7961CRITICALunder attack09 Apr 2021
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2020-1938CRITICALunder attack08 Apr 2021
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2019-19781CRITICALunder attackransomware06 Apr 2021
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-1472MEDIUMunder attackransomware06 Apr 2021
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21972CRITICALunder attackransomware06 Apr 2021
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21975CRITICALunder attackransomware06 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack05 Apr 2021
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-9805HIGHunder attack04 Apr 2021
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2020-17453—03 Apr 2021
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
43RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975CRITICALunder attackransomware02 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-1732HIGHunder attackransomware02 Apr 2021
Windows Win32k Elevation of Privilege Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-9496—01 Apr 2021
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975CRITICALunder attackransomware01 Apr 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975CRITICALunder attackransomware31 Mar 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975CRITICALunder attackransomware31 Mar 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-14882CRITICALunder attack31 Mar 2021
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-21975CRITICALunder attackransomware31 Mar 2021
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
local
CVE-2014-0196MEDIUMunder attack30 Mar 2021
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
68RISK
open ↗
VulnCheck XDB
local
CVE-2019-2215HIGHunder attack30 Mar 2021
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-22555HIGHunder attack30 Mar 2021
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RISK
open ↗
VulnCheck XDB
local
CVE-2016-0728—30 Mar 2021
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
23RISK
open ↗
VulnCheck XDB
local
CVE-2013-2094HIGHunder attack30 Mar 2021
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t
83RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack30 Mar 2021
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
local
CVE-2012-0056—30 Mar 2021
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when
28RISK
open ↗
← previouspage 285 / 338next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.