Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,151cataloged exploits

35,370CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecent popular risk

14,096 exploits

GitHub PoC★ 4

个人整理的Centos7.x + Kubernetes-1.12.3 + Dashboard-1.8.3 无 CVE-2018-1002105 漏洞的master节点全自动快速一键安装部署文件，适用于测试环境，生产环境的快速安装部署

CVE-2018-1002105CRITICAL10 Dec 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

GitHub PoC★ 2

Proof of consept for CVE-2018-17431

CVE-2018-17431—08 Dec 2018

Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication

60RISK

GitHub PoC★ 222

PoC for CVE-2018-1002105.

CVE-2018-1002105CRITICAL06 Dec 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

GitHub PoC★ 13

CVE-2018-15982_PoC

CVE-2018-15982HIGHunder attackransomware06 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

GitHub PoC★ 9

Unrestricted file upload in Adobe ColdFusion

CVE-2018-15961CRITICALunder attack06 Dec 2018

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unr

100RISK

GitHub PoC

Flash sources for CVE-2018-15982 used by NK

CVE-2018-15982HIGHunder attackransomware05 Dec 2018

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful

93RISK

GitHub PoC

uzzzval/cve-2004-2167

CVE-2004-2167—05 Dec 2018

Multiple buffer overflows in LaTeX2rtf 1.9.15, and possibly other versions, allow remote attackers to execute arbitrary

28RISK

GitHub PoC★ 191

Test utility for cve-2018-1002105

CVE-2018-1002105CRITICAL05 Dec 2018

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

GitHub PoC★ 4

dnsmasq rop exploit with NX bypass

CVE-2017-14493—04 Dec 2018

Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu

45RISK

GitHub PoC

CVE-2014-8682

CVE-2014-8682—04 Dec 2018

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow r

50RISK

GitHub PoC

CVE-2014-4511

CVE-2014-4511—03 Dec 2018

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in

60RISK

GitHub PoC

This is an exploitation guide for CVE-2016-2233

CVE-2016-2233—03 Dec 2018

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC serve

35RISK

GitHub PoC★ 1

A collection of code pertaining to CVE-2016-0728 (various authors)

CVE-2016-0728—03 Dec 2018

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref

23RISK

GitHub PoC

A VENOM (CVE-2015-3456) Exploit / PoC written in C.

CVE-2015-3456—03 Dec 2018

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a

28RISK

GitHub PoC

CVE-2016-1240 exploit and patch

CVE-2016-1240—02 Dec 2018

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

38RISK

GitHub PoC★ 104

CVE-2018-8021 Proof-Of-Concept and Exploit

CVE-2018-8021—02 Dec 2018

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos

35RISK

GitHub PoC★ 39

PrestaShop (1.6.x <= 1.6.1.23 or 1.7.x <= 1.7.4.4) Back Office Remote Code Execution (CVE-2018-19126)

CVE-2018-19126—01 Dec 2018

PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file u

28RISK

GitHub PoC★ 50

All about CVE-2018-14667; From what it is to how to successfully exploit it.

CVE-2018-14667CRITICALunder attack30 Nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISK

GitHub PoC★ 1

about CVE-2018-14667 from RichFaces Framework 3.3.4

CVE-2018-14667CRITICALunder attack28 Nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISK

GitHub PoC

lol-fi/cve-2011-4862

CVE-2011-4862—28 Nov 2018

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka k

60RISK

GitHub PoC★ 1

The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10

CVE-2018-7691MEDIUM26 Nov 2018

MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access

33RISK

GitHub PoC★ 1

The SSC REST API contains Insecure Direct Object Reference (IDOR) vulnerabilities in Fortify Software Security Center (SSC) 17.10, 17.20 & 18.10

CVE-2018-7690MEDIUM26 Nov 2018

MFSBGN03835 rev.1 - Fortify Software Security Center (SSC), Remote Unauthorized Access

33RISK

GitHub PoC★ 15

RTSPServer Code Execution Vulnerability CVE-2018-4013

CVE-2018-4013CRITICAL24 Nov 2018

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server l

48RISK

GitHub PoC★ 2

zeroto01/CVE-2018-14667

CVE-2018-14667CRITICALunder attack23 Nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISK

GitHub PoC★ 1

un4ckn0wl3z/CVE-2017-5638

CVE-2017-5638CRITICALunder attackransomware22 Nov 2018

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISK

GitHub PoC

libSSH bypass

CVE-2018-10933CRITICAL21 Nov 2018

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

85RISK

GitHub PoC

tafamace/CVE-2016-0793

CVE-2016-0793—19 Nov 2018

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Se

28RISK

GitHub PoC

tafamace/CVE-2017-17485

CVE-2017-17485CRITICAL19 Nov 2018

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because o

60RISK

GitHub PoC★ 83

Tool for CVE-2018-16323

CVE-2018-16323—18 Nov 2018

ReadXBMImage in coders/xbm.c in ImageMagick before 7.0.8-9 leaves data uninitialized when processing an XBM file that ha

35RISK

GitHub PoC

cve-2018-14667 demo

CVE-2018-14667CRITICALunder attack18 Nov 2018

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resou

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.