Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,950cataloged exploits
39,792CVEs with public exploitation
24,695lab-tested
AllReferência 25,790Exploit-DB 24,487GitHub PoC 16,905VulnCheck XDB 9,736Nuclei 4,504Metasploit 3,528✓ verified onlyrecentpopularrisk
3,523 exploits
Metasploit600
Exim "perl_startup" Privilege Escalation
CVE-2016-1531—10 Mar 2016
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
38RISK
open ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8733—06 Mar 2016
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an
43RISK
open ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8736—06 Mar 2016
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RC
50RISK
open ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8735—06 Mar 2016
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execut
50RISK
open ↗
Metasploit0
Apache Jetspeed Arbitrary File Upload
CVE-2016-0709—06 Mar 2016
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3
60RISK
open ↗
Metasploit0
Apache Jetspeed Arbitrary File Upload
CVE-2016-0710—06 Mar 2016
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attacker
50RISK
open ↗
Metasploit600
Nagios XI Chained Remote Code Execution
CVE-2018-8734—06 Mar 2016
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker
50RISK
open ↗
Metasploit600
ATutor 2.2.1 Directory Traversal / Remote Code Execution
CVE-2016-2555—01 Mar 2016
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbi
60RISK
open ↗
Metasploit600
ATutor 2.2.1 Directory Traversal / Remote Code Execution
CVE-2017-1000002—01 Mar 2016
ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course
30RISK
open ↗
Metasploit600
ATutor 2.2.1 SQL Injection / Remote Code Execution
CVE-2016-2555—01 Mar 2016
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbi
60RISK
open ↗
Metasploit600
Ruby on Rails ActionPack Inline ERB Code Execution
CVE-2016-2098—01 Mar 2016
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to e
60RISK
open ↗
Metasploit600
Netgear Devices Unauthenticated Remote Command Execution
CVE-2016-1555CRITICALunder attack25 Feb 2016
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
100RISK
open ↗
Metasploit600
Jenkins XStream Groovy classpath Deserialization Vulnerability
CVE-2016-0792—24 Feb 2016
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
60RISK
open ↗
Metasploit600
Primefaces Remote Code Execution Exploit
CVE-2017-1000486CRITICALunder attack15 Feb 2016
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
100RISK
open ↗
Metasploit600
Xymon useradm Command Execution
CVE-2016-2056—14 Feb 2016
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via
50RISK
open ↗
Metasploit600
Ubiquiti airOS Arbitrary File Upload
CVE-2015-9266CRITICAL13 Feb 2016
Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload
85RISK
open ↗
Metasploit600
MS16-016 mrxdav.sys WebDav Local Privilege Escalation
CVE-2016-0051—09 Feb 2016
The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window
43RISK
open ↗
Metasploit600
Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload
CVE-2016-0854—05 Feb 2016
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess
60RISK
open ↗
Metasploit500
D-Link DSL-2750B OS Command Injection
CVE-2016-20017CRITICALunder attack05 Feb 2016
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as
100RISK
open ↗
Metasploit600
NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
CVE-2023-38096CRITICAL04 Feb 2016
NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability
65RISK
open ↗
Metasploit300
NETGEAR ProSafe Network Management System 300 Authenticated File Download
CVE-2016-1524—04 Feb 2016
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote
60RISK
open ↗
Metasploit600
NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
CVE-2016-1525—04 Feb 2016
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allow
60RISK
open ↗
Metasploit600
NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
CVE-2023-38098HIGH04 Feb 2016
NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability
41RISK
open ↗
Metasploit600
lastore-daemon D-Bus Privilege Escalation
CVE-2016-15045HIGH02 Feb 2016
Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation
36RISK
open ↗
Metasploit600
Oracle ATS Arbitrary File Upload
CVE-2016-0491—20 Jan 2016
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RISK
open ↗
Metasploit600
Oracle ATS Arbitrary File Upload
CVE-2016-0492—20 Jan 2016
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12
60RISK
open ↗
Metasploit300
Windows Net-NTLMv2 Reflection DCOM/RPC
CVE-2016-3225—16 Jan 2016
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
50RISK
open ↗
Metasploit500
Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)
CVE-2016-3225—16 Jan 2016
The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
50RISK
open ↗
Metasploit300
Fortinet SSH Backdoor Scanner
CVE-2016-1909—09 Jan 2016
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
60RISK
open ↗
Metasploit600
TP-Link SC2020n Authenticated Telnet Injection
CVE-2013-2578—20 Dec 2015
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models be
60RISK
open ↗
← previouspage 49 / 118next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.