Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC★ 8

sv3nbeast/CVE-2020-5902_RCE

CVE-2020-5902CRITICALunder attackransomware06 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 1

BIG-IP F5 Remote Code Execution

CVE-2020-5902CRITICALunder attackransomware06 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 10

批量扫描CVE-2020-5902，远程代码执行，已测试

CVE-2020-5902CRITICALunder attackransomware06 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC

Patch F5 appliance CVE-2020-5902

CVE-2020-5902CRITICALunder attackransomware06 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 1

CVE-2020-5902

CVE-2020-5902CRITICALunder attackransomware06 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 2

CVE-2020-5902 scanner

CVE-2020-5902CRITICALunder attackransomware06 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 374

CVE-2020-5902 BIG-IP

CVE-2020-5902CRITICALunder attackransomware05 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 8

rwincey/CVE-2020-5902-NSE

CVE-2020-5902CRITICALunder attackransomware05 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 70

Proof of concept for CVE-2020-5902

CVE-2020-5902CRITICALunder attackransomware05 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 8

nsflabs/CVE-2020-5902

CVE-2020-5902CRITICALunder attackransomware05 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 12

POC code for checking for this vulnerability. Since the code has been released, I decided to release this one as well. Patch Immediately!

CVE-2020-5902CRITICALunder attackransomware05 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 55

Automated script for F5 BIG-IP scanner (CVE-2020-5902) using hosts retrieved from Shodan API.

CVE-2020-5902CRITICALunder attackransomware05 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC★ 9

CVE-2020-5902

CVE-2020-5902CRITICALunder attackransomware04 Jul 2020

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

100RISK

GitHub PoC

Simple OpenSSL TLS Heartbeat (CVE-2014-0160) Scanner and Exploit (Multiple SSL/TLS versions)

CVE-2014-0160HIGHunder attack04 Jul 2020

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

GitHub PoC

Kenun99/CVE-2019-16113-Dockerfile

CVE-2019-16113—03 Jul 2020

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j

60RISK

GitHub PoC★ 17

The official exploit for OCS Inventory NG v2.7 Remote Command Execution CVE-2020-14947

CVE-2020-14947—02 Jul 2020

OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php bec

28RISK

GitHub PoC★ 2

reversebrain/CVE-2019-18988

CVE-2019-18988HIGHunder attack01 Jul 2020

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for dif

86RISK

GitHub PoC★ 1

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Python3)

CVE-2006-3392—30 Jun 2020

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote

60RISK

GitHub PoC★ 19

CVE-2013-2028 python exploit

CVE-2013-2028—27 Jun 2020

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau

60RISK

GitHub PoC

cyberharsh/Shellbash-CVE-2014-6271

CVE-2014-6271CRITICALunder attack26 Jun 2020

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

100RISK

GitHub PoC★ 1

cyberharsh/DrupalCVE-2018-7602

CVE-2018-7602HIGHunder attackransomware25 Jun 2020

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

100RISK

GitHub PoC

cyberharsh/Tomcat-CVE-2017-12615

CVE-2017-12615HIGHunder attackransomware24 Jun 2020

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati

100RISK

GitHub PoC

Bludit 3.9.2 - bruteforce bypass - CVE-2019-17240

CVE-2019-17240LOW24 Jun 2020

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many

40RISK

GitHub PoC★ 1

cyberharsh/Oracle-mysql-CVE-2012-2122

CVE-2012-2122—24 Jun 2020

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor

60RISK

GitHub PoC

cyberharsh/Php-unit-CVE-2017-9841

CVE-2017-9841CRITICALunder attack24 Jun 2020

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c

100RISK

GitHub PoC

cyberharsh/Groovy-scripting-engine-CVE-2015-1427

CVE-2015-1427CRITICALunder attack22 Jun 2020

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s

100RISK

GitHub PoC★ 1

Python version of Metasploit exploit for CVE-2004-1561

CVE-2004-1561—22 Jun 2020

Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with

60RISK

GitHub PoC★ 3

cyberharsh/Nginx-CVE-2013-4547

CVE-2013-4547—20 Jun 2020

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap

35RISK

GitHub PoC

cdedmondson/Modified-CVE-2019-15107

CVE-2019-15107CRITICALunder attackransomware20 Jun 2020

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

GitHub PoC★ 1

cyberharsh/Apache-couchdb-CVE-2017-12635

CVE-2017-12635—19 Jun 2020

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be

60RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.