Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
4,357 exploits
Nucleihigh
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - Broken Access Control
CVE-2019-2578—
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo
40RISK
open ↗
Nucleimedium
Oracle Fusion Middleware WebCenter Sites 12.2.1.3.0 - SQL Injection
CVE-2019-2579—
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The suppo
18RISK
open ↗
Nucleimedium
Oracle Business Intelligence - Path Traversal
CVE-2019-2588—
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
50RISK
open ↗
Nucleihigh
Oracle Business Intelligence/XML Publisher - XML External Entity Injection
CVE-2019-2616HIGHunder attack
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
100RISK
open ↗
Nucleicritical
Oracle WebLogic Server - Remote Command Execution
CVE-2019-2725HIGHunder attackransomware
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗
Nucleicritical
Oracle WebLogic Server Administration Console - Remote Code Execution
CVE-2019-2729CRITICAL
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
Nucleihigh
Oracle Business Intelligence Publisher - XML External Entity Injection
CVE-2019-2767—
Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publi
18RISK
open ↗
Nucleicritical
Atlassian Confluence Server - Path Traversal
CVE-2019-3396CRITICALunder attackransomware
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RISK
open ↗
Nucleihigh
Atlassian Confluence Download Attachments - Remote Code Execution
CVE-2019-3398HIGHunder attack
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote at
100RISK
open ↗
Nucleimedium
Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
CVE-2019-3401—
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote
23RISK
open ↗
Nucleimedium
Jira < 8.1.1 - Cross-Site Scripting
CVE-2019-3402—
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows
18RISK
open ↗
Nucleimedium
Jira - Incorrect Authorization
CVE-2019-3403—
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and fr
30RISK
open ↗
Nucleimedium
Spring Cloud Config Server - Local File Inclusion
CVE-2019-3799—
Directory Traversal with spring-cloud-config-server
60RISK
open ↗
Nucleimedium
LabKey Server Community Edition <18.3.0 - Cross-Site Scripting
CVE-2019-3911—
Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an
18RISK
open ↗
Nucleimedium
LabKey Server Community Edition <18.3.0 - Open Redirect
CVE-2019-3912—
An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL param
18RISK
open ↗
Nucleicritical
Barco/AWIND OEM Presentation Platform - Remote Command Injection
CVE-2019-3929CRITICALunder attack
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Nucleimedium
IBM BigFix Platform - Information Disclosure
CVE-2019-4061MEDIUM
IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the upd
33RISK
open ↗
Nucleicritical
IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection
CVE-2019-4716CRITICALunder attack
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
100RISK
open ↗
Nucleicritical
YouPHPTube Encoder 2.3 - Remote Command Injection
CVE-2019-5127CRITICAL
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗
Nucleicritical
YouPHPTube Encoder - Arbitrary File Write
CVE-2019-5128CRITICAL
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗
Nucleicritical
YouPHPTube Encoder 2.3 - Command Injection
CVE-2019-5129CRITICAL
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the
55RISK
open ↗
Nucleihigh
Rails File Content Disclosure
CVE-2019-5418HIGHunder attack
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where spe
100RISK
open ↗
Nucleicritical
Revive Adserver 4.2 - Remote Code Execution
CVE-2019-5434—
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() cal
50RISK
open ↗
Nucleimedium
FortiOS - Insecure LDAP Configuration Detection
CVE-2019-5591MEDIUMunder attackransomware
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept s
83RISK
open ↗
Nucleimedium
WordPress Sell Media 2.4.1 - Cross-Site Scripting
CVE-2019-6112—
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows
18RISK
open ↗
Nucleihigh
Drupal - Remote Code Execution
CVE-2019-6340HIGHunder attack
Drupal core - Highly critical - Remote Code Execution
100RISK
open ↗
Nucleicritical
Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update
CVE-2019-6703—
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for Wor
23RISK
open ↗
Nucleihigh
W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal
CVE-2019-6715—
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via
23RISK
open ↗
Nucleihigh
GitLab Enterprise Edition - Server-Side Request Forgery
CVE-2019-6793—
An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The
18RISK
open ↗
Nucleimedium
phpMyAdmin <4.8.5 - Local File Inclusion
CVE-2019-6799—
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true,
23RISK
open ↗
← previouspage 30 / 146next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.