Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,542cataloged exploits

34,971CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 13,947VulnCheck XDB 8,542Nuclei 4,243Metasploit 3,468✓ verified onlyrecent popular risk

13,947 exploits

GitHub PoC

https://www.exploit-db.com/exploits/49757

CVE-2011-2523—31 Aug 2021

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISK

open ↗

GitHub PoC★ 1

Remote Code Execution vulnerability in PHPMailer.

CVE-2016-10033CRITICALunder attack31 Aug 2021

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para

100RISK

open ↗

GitHub PoC★ 48

ProxyToken (CVE-2021-33766) : An Authentication Bypass in Microsoft Exchange Server POC exploit

CVE-2021-33766HIGHunder attack31 Aug 2021

Microsoft Exchange Server Information Disclosure Vulnerability

100RISK

open ↗

GitHub PoC★ 4

Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data.

CVE-2016-2098—31 Aug 2021

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to e

60RISK

open ↗

GitHub PoC★ 19

Exploit code for CVE-2019-17662

CVE-2019-17662—31 Aug 2021

ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exi

60RISK

open ↗

GitHub PoC★ 21

CVE-2021-26084 - Confluence Pre-Auth RCE | OGNL injection

CVE-2021-26084CRITICALunder attackransomware31 Aug 2021

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

GitHub PoC★ 53

alt3kx/CVE-2021-26084_PoC

CVE-2021-26084CRITICALunder attackransomware31 Aug 2021

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

GitHub PoC

Strapi <= 3.0.0-beta.17.8 authenticated remote code execution

CVE-2019-19609—30 Aug 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

open ↗

GitHub PoC★ 7

Strapi Framework Vulnerable to Remote Code Execution

CVE-2019-19609—29 Aug 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

open ↗

GitHub PoC★ 9

Exploit for CVE-2019-19609 in Strapi (Remote Code Execution)

CVE-2019-19609—29 Aug 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

open ↗

GitHub PoC★ 3

guglia001/CVE-2019-18818

CVE-2019-18818—29 Aug 2021

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISK

open ↗

GitHub PoC★ 1

Citrix ADC RCE cve-2019-19781

CVE-2019-19781CRITICALunder attackransomware29 Aug 2021

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

100RISK

open ↗

GitHub PoC★ 11

CVE-2020-25223

CVE-2020-25223CRITICALunder attack29 Aug 2021

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511

100RISK

open ↗

GitHub PoC

BabyTeam1024/CVE-2017-3248

CVE-2017-3248—29 Aug 2021

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Suppo

60RISK

open ↗

GitHub PoC★ 1

CVE-2004-2687 DistCC Daemon Command Execution

CVE-2004-2687—28 Aug 2021

distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at

60RISK

open ↗

GitHub PoC

AssassinUKG/CVE-2021-29447

CVE-2021-29447HIGH27 Aug 2021

WordPress Authenticated XXE attack when installation is running PHP 8

63RISK

open ↗

GitHub PoC★ 1

A proof of concept for CVE-2016-6515

CVE-2016-6515—26 Aug 2021

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a

35RISK

open ↗

GitHub PoC★ 1

Kibana Prototype Pollution

CVE-2019-7609CRITICALunder attack24 Aug 2021

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker

100RISK

open ↗

GitHub PoC★ 24

my exp for chrome V8 CVE-2021-30551

CVE-2021-30551HIGHunder attack22 Aug 2021

Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corru

83RISK

open ↗

GitHub PoC★ 1

An implementation of CVE-2015-3306

CVE-2015-3306—21 Aug 2021

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and

60RISK

open ↗

GitHub PoC

rood8008/CVE-2021-35464

CVE-2021-35464CRITICALunder attackransomware21 Aug 2021

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa

100RISK

open ↗

GitHub PoC★ 11

CVE-2018-19320 LPE Exploit

CVE-2018-19320HIGHunder attackransomware19 Aug 2021

The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING

71RISK

open ↗

GitHub PoC★ 1

CVE-2019-11932

CVE-2019-11932—17 Aug 2021

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version

35RISK

open ↗

GitHub PoC★ 1

A tool to crash MySQL servers with CVE-2017-3599

CVE-2017-3599—16 Aug 2021

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Pluggable Auth). Supported versions t

45RISK

open ↗

GitHub PoC★ 1

Multiple Stored XSS Online Doctor Appointment System

CVE-2021-25791—16 Aug 2021

Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment S

23RISK

open ↗

GitHub PoC★ 30

CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-34473CRITICALunder attackransomware16 Aug 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC

The Heartbleed bug `CVE-2014-0160` is a severe implementation flaw in the OpenSSL library, which enables attackers to steal data from the memory of the victim server. The contents of the stolen data depend on what is there in the memory of the server. It could potentially contain private keys, TLS session keys, usernames, passwords, credit cards, etc. The vulnerability is in the implementation of the Heartbeat protocol, which is used by SSL/TLS to keep the connection alive.

CVE-2014-0160HIGHunder attack15 Aug 2021

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

open ↗

GitHub PoC★ 1

tools for automate configure Ubuntu 20.04 enviroment for testing CVE-2021-28476.

CVE-2021-28476CRITICAL15 Aug 2021

Windows Hyper-V Remote Code Execution Vulnerability

60RISK

open ↗

GitHub PoC★ 3

WordPress File Upload Vulnerability, Modern Events Calendar Lite WordPress plugin before 5.16.5

CVE-2021-24145—14 Aug 2021

Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE

60RISK

open ↗

GitHub PoC★ 1

An implementation of CVE-2020-1938

CVE-2020-1938CRITICALunder attack14 Aug 2021

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.