Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,058cataloged exploits
35,300CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,175GitHub PoC 14,096VulnCheck XDB 8,607Nuclei 4,255Metasploit 3,474✓ verified onlyrecentpopularrisk
14,080 exploits
GitHub PoC★ 6
A fix for CVE-2019-11358 (prototype pollution in jquery)
CVE-2019-11358—18 Jul 2019
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
45RISK
open ↗
GitHub PoC
CVE-2019-0708
CVE-2019-0708CRITICALunder attackransomware18 Jul 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 18
CVE-2019-0708 Exploit Tool
CVE-2019-0708CRITICALunder attackransomware18 Jul 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 3
Scanner PoC for CVE-2019-0708 RDP RCE vuln
CVE-2019-0708CRITICALunder attackransomware18 Jul 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 1
CVE-2019-2107
CVE-2019-2107—17 Jul 2019
In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. Th
23RISK
open ↗
GitHub PoC★ 105
CVE-2019-11580 Atlassian Crowd and Crowd Data Center RCE
CVE-2019-11580CRITICALunder attackransomware17 Jul 2019
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attac
100RISK
open ↗
GitHub PoC★ 1
软件系统安全结课作业：[漏洞复现] CVE-2018-4878 Flash 0day
CVE-2018-4878HIGHunder attackransomware17 Jul 2019
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISK
open ↗
GitHub PoC★ 92
Atlassian JIRA Template injection vulnerability RCE
CVE-2019-11581CRITICALunder attack16 Jul 2019
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators an
100RISK
open ↗
GitHub PoC
Proof of concept tool to exploit the directory traversal and local file inclusion vulnerability that resides in the Sahi-pro web application CVE-2019-13063
CVE-2019-13063—15 Jul 2019
Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the sc
28RISK
open ↗
GitHub PoC★ 1
CVE-2019-9766 React
CVE-2019-9766—14 Jul 2019
Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to
23RISK
open ↗
GitHub PoC★ 23
Metasploit module for massive Denial of Service using #Bluekeep vector.
CVE-2019-0708CRITICALunder attackransomware14 Jul 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 4
R/W
CVE-2019-0539—12 Jul 2019
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗
GitHub PoC★ 14
thepwnrip/leHACK-Analysis-of-CVE-2018-8453
CVE-2018-8453HIGHunder attackransomware08 Jul 2019
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
100RISK
open ↗
GitHub PoC★ 4
PHP-CGI-REMOTE_CVE-2012-1823, UnrealIRCd, MySQL, PostgreSQL and SSH bruteforce, VSFTPD2.3.4, samba CVE-2007-2447, JAVA RMI Server, distcc daemon, misconfigured NFS files, etc.
CVE-2012-1823CRITICALunder attack05 Jul 2019
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RISK
open ↗
GitHub PoC★ 4
PHP-CGI-REMOTE_CVE-2012-1823, UnrealIRCd, MySQL, PostgreSQL and SSH bruteforce, VSFTPD2.3.4, samba CVE-2007-2447, JAVA RMI Server, distcc daemon, misconfigured NFS files, etc.
CVE-2007-2447—05 Jul 2019
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗
GitHub PoC★ 12
ze0r/CVE-2019-0708-exp
CVE-2019-0708CRITICALunder attackransomware04 Jul 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC
https://github.com/Yt1g3r/CVE-2019-3396_EXP.git
CVE-2019-3396CRITICALunder attackransomware01 Jul 2019
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from vers
100RISK
open ↗
GitHub PoC★ 3
TrungNguyen1909/CVE-2019-6225-macOS
CVE-2019-6225—30 Jun 2019
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.
28RISK
open ↗
GitHub PoC
Proof of concept code for breaking out of docker via runC
CVE-2019-5736—30 Jun 2019
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗
GitHub PoC★ 9
CVE-2019-10149 privilege escalation
CVE-2019-10149CRITICALunder attack27 Jun 2019
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
open ↗
GitHub PoC★ 99
cve-2019-0604 SharePoint RCE exploit
CVE-2019-0604CRITICALunder attackransomware26 Jun 2019
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup
100RISK
open ↗
GitHub PoC★ 1
spectre v4 : Speculative Store Bypass (CVE-2018-3639) proof of concept for Linux
CVE-2018-3639MEDIUM26 Jun 2019
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
45RISK
open ↗
GitHub PoC
CVE-2017-8759 微软word漏洞利用脚本
CVE-2017-8759HIGHunder attack25 Jun 2019
Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely vi
93RISK
open ↗
GitHub PoC
Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.
CVE-2018-11776HIGHunder attack24 Jun 2019
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗
GitHub PoC★ 70
Weblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行
CVE-2019-2725HIGHunder attackransomware24 Jun 2019
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗
GitHub PoC★ 14
POC CVE-2019-0708 with python script!
CVE-2019-0708CRITICALunder attackransomware24 Jun 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 5
CVE-2018-17456漏洞复现（PoC+Exp）
CVE-2018-17456—21 Jun 2019
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x be
60RISK
open ↗
GitHub PoC★ 9
CVE-2015-3337 ElasticSearch 任意文件读取
CVE-2015-3337—21 Jun 2019
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
50RISK
open ↗
GitHub PoC★ 3
CVE-2017-1000117漏洞复现（PoC+Exp）
CVE-2017-1000117—20 Jun 2019
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
60RISK
open ↗
GitHub PoC★ 1
wdfcc/CVE-2019-0708
CVE-2019-0708CRITICALunder attackransomware20 Jun 2019
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
← previouspage 423 / 470next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.