Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,037cataloged exploits

39,796CVEs with public exploitation

24,695lab-tested

All Referência 25,790Exploit-DB 24,487GitHub PoC 16,908VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecent popular risk

3,523 exploits

Metasploit300

Juniper SSH Backdoor Scanner

CVE-2015-7755CRITICALunder attack20 Dec 2015

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r

100RISK

Metasploit600

D-Link DCS-930L Authenticated Remote Command Execution

CVE-2016-11021HIGHunder attack20 Dec 2015

setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in th

98RISK

Metasploit600

blueman set_dhcp_handler D-Bus Privilege Escalation

CVE-2015-8612—18 Dec 2015

The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users

38RISK

Metasploit300

Symantec Messaging Gateway 10 Exposure of Stored AD Password Vulnerability

CVE-2016-2203—17 Dec 2015

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discove

38RISK

Metasploit300

IBM Tivoli Storage Manager FastBack Server Opcode 0x534 Denial of Service

CVE-2015-1930—15 Dec 2015

Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attacke

18RISK

Metasploit600

Joomla HTTP Header Unauthenticated Remote Code Execution

CVE-2015-8562—14 Dec 2015

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi

60RISK

Metasploit600

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability

CVE-2015-8249—14 Dec 2015

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e

60RISK

Metasploit300

Office OLE Multiple DLL Side Loading Vulnerabilities

CVE-2015-6132—08 Dec 2015

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2

60RISK

Metasploit300

Office OLE Multiple DLL Side Loading Vulnerabilities

CVE-2015-6128—08 Dec 2015

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allo

60RISK

Metasploit300

Office OLE Multiple DLL Side Loading Vulnerabilities

CVE-2016-0041—08 Dec 2015

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an

60RISK

Metasploit300

Office OLE Multiple DLL Side Loading Vulnerabilities

CVE-2016-0100—08 Dec 2015

Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges v

50RISK

Metasploit300

Office OLE Multiple DLL Side Loading Vulnerabilities

CVE-2016-3235HIGHunder attack08 Dec 2015

Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 misha

98RISK

Metasploit300

Office OLE Multiple DLL Side Loading Vulnerabilities

CVE-2015-6133—08 Dec 2015

Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511

50RISK

Metasploit300

MS15-134 Microsoft Windows Media Center MCL Information Disclosure

CVE-2015-6127—08 Dec 2015

Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers t

50RISK

Metasploit300

Windows WMI Receive Notification Exploit

CVE-2016-0040HIGHunder attack04 Dec 2015

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to g

91RISK

Metasploit300

Easy File Sharing HTTP Server 7.2 SEH Overflow

CVE-2018-9059—02 Dec 2015

Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code

60RISK

Metasploit600

Advantech Switch Bash Environment Variable Code Injection (Shellshock)

CVE-2014-6271CRITICALunder attack01 Dec 2015

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

Metasploit600

Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5)

CVE-2017-5255—28 Nov 2015

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web

60RISK

Metasploit600

ABRT sosreport Privilege Escalation

CVE-2015-5287HIGHunder attack23 Nov 2015

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain perm

86RISK

Metasploit600

Jenkins CLI RMI Java Deserialization Vulnerability

CVE-2015-8103—18 Nov 2015

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co

60RISK

Metasploit600

IBM WebSphere RCE Java Deserialization Vulnerability

CVE-2015-7450CRITICALunder attack06 Nov 2015

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and

100RISK

Metasploit300

OpenNMS Java Object Unserialization Remote Code Execution

CVE-2015-8103—06 Nov 2015

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co

60RISK

Metasploit600

vBulletin 5.1.2 Unserialize Code Execution

CVE-2015-7808—04 Nov 2015

The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PH

60RISK

Metasploit600

Atlassian HipChat for Jira Plugin Velocity Template Injection

CVE-2015-5603—28 Oct 2015

The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java

50RISK

Metasploit600

Joomla Content History SQLi Remote Code Execution

CVE-2015-7858—23 Oct 2015

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un

60RISK

Metasploit600

Joomla Content History SQLi Remote Code Execution

CVE-2015-7857—23 Oct 2015

SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p

60RISK

Metasploit600

Joomla Content History SQLi Remote Code Execution

CVE-2015-7297—23 Oct 2015

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un

60RISK

Metasploit300

Joomla com_contenthistory Error-Based SQL Injection

CVE-2015-7297—22 Oct 2015

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via un

60RISK

Metasploit0

Safari User-Assisted Applescript Exec Attack

CVE-2015-7007—16 Oct 2015

Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement f

50RISK

Metasploit300

Limesurvey Unauthenticated File Download

CVE-2025-34120HIGH12 Oct 2015

LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup Payload

36RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.