Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,958cataloged exploits
36,206CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,460Referência 22,832GitHub PoC 14,991VulnCheck XDB 8,829Nuclei 4,357Metasploit 3,489✓ verified onlyrecentpopularrisk
3,477 exploits
Metasploit600
Trend Micro OfficeScan Remote Code Execution
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitr
50RISK
open ↗Metasploit600
HP Intelligent Management Java Deserialization RCE
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and e
60RISK
open ↗Metasploit600
Tomcat RCE via JSP Upload Bypass
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISK
open ↗Metasploit600
phpCollab 2.5.1 Unauthenticated File Upload
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authentica
60RISK
open ↗Metasploit300
CyberLink LabelPrint 2.5 Stack Buffer Overflow
Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) au
43RISK
open ↗Metasploit300
Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a vulnerable Hikvision IP Camera
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISK
open ↗Metasploit300
Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISK
open ↗Metasploit600
DenyAll Web Application Firewall Remote Code Execution
DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf
23RISK
open ↗Metasploit300
Apache Optionsbleed Scanner
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
60RISK
open ↗Metasploit600
xdebug Unauthenticated OS Command Execution
Xdebug Remote Debugger Unauthenticated OS Command Execution
63RISK
open ↗Metasploit600
Kaltura Remote PHP Code Execution over Cookie
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, wh
60RISK
open ↗Metasploit600
Apache Struts 2 REST Plugin XStream RCE
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RISK
open ↗Metasploit600
Mako Server v2.5, 2.6 OS Command Injection RCE
Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp
63RISK
open ↗Metasploit600
Zivif Camera iptest.cgi Blind Remote Command Execution
Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauth
40RISK
open ↗Metasploit300
IBM Notes Denial Of Service
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it woul
43RISK
open ↗Metasploit300
Open WAN-to-LAN proxy on AT&T routers
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, conf
18RISK
open ↗Metasploit300
IBM Notes encodeURI DOS
IBM Notes 8.5 and 9.0 is vulnerable to a denial of service. If a user is persuaded to click on a malicious link, it coul
50RISK
open ↗Metasploit600
Disk Pulse Enterprise GET Buffer Overflow
A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9
40RISK
open ↗Metasploit300
HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation
A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53
60RISK
open ↗Metasploit400
Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE
43RISK
open ↗Metasploit600
Malicious Git HTTP Server For CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
60RISK
open ↗Metasploit600
DIR-850L (Un)authenticated OS Command Exec
On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SER
23RISK
open ↗Metasploit600
Unitrends UEB bpserverd authentication bypass RCE
It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xin
50RISK
open ↗Metasploit600
Unitrends UEB http api remote code execution
It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of
60RISK
open ↗Metasploit600
Unitrends UEB http api remote code execution
It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, w
50RISK
open ↗Metasploit600
QNAP Transcode Server Command Execution
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
23RISK
open ↗Metasploit0
Android Janus APK Signature bypass
An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0,
43RISK
open ↗Metasploit600
Western Digital MyCloud multi_uploadify File Upload Vulnerability
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component, /web/jquer
60RISK
open ↗Metasploit600
Nitro Pro PDF Reader 11.0.3.173 Javascript API Remote Code Execution
Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory tra
50RISK
open ↗Metasploit600
DotNetNuke Cookie Deserialization Remote Code Excecution
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.