Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits

40,553CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

18,078 exploits

GitHub PoC★ 178

Base64-based encryption oracle exploit for CVE-2017-9248 (Telerik UI for ASP.NET AJAX dialog handler)

CVE-2017-9248CRITICALunder attack16 Jan 2018

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not

100RISK

open ↗

GitHub PoC★ 5

CVE-2017-10271 Weblogic 漏洞验证Poc及补丁

CVE-2017-10271HIGHunder attackransomware16 Jan 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RISK

open ↗

GitHub PoC

likekabin/CVE-2017-11882

CVE-2017-11882HIGHunder attackransomware16 Jan 2018

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

open ↗

GitHub PoC★ 11

likekabin/CVE-2018-0802_CVE-2017-11882

CVE-2017-11882HIGHunder attackransomware16 Jan 2018

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

open ↗

GitHub PoC

Assesses a system for the "speculative execution" vulnerabilities described in CVE-2017-5715, CVE-2017-5753, CVE-2017-5754

CVE-2017-5715MEDIUM15 Jan 2018

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RISK

open ↗

GitHub PoC★ 17

a list of BIOS/Firmware fixes adressing CVE-2017-5715, CVE-2017-5753, CVE-2017-5754

CVE-2017-5715MEDIUM14 Jan 2018

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RISK

open ↗

GitHub PoC★ 166

PoC for CVE-2018-0802 And CVE-2017-11882

CVE-2018-0802HIGHunder attackransomware12 Jan 2018

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow

93RISK

open ↗

GitHub PoC★ 166

PoC for CVE-2018-0802 And CVE-2017-11882

CVE-2017-11882HIGHunder attackransomware12 Jan 2018

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

open ↗

GitHub PoC★ 68

Exploit the vulnerability to execute the calculator

CVE-2018-0802HIGHunder attackransomware11 Jan 2018

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow

93RISK

open ↗

GitHub PoC★ 270

PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)

CVE-2018-0802HIGHunder attackransomware11 Jan 2018

Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow

93RISK

open ↗

GitHub PoC★ 270

PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)

CVE-2017-11882HIGHunder attackransomware11 Jan 2018

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

open ↗

GitHub PoC★ 183

Proof of Concept exploit for CVE-2017-8570

CVE-2017-8570HIGHunder attack09 Jan 2018

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Mic

93RISK

open ↗

GitHub PoC★ 179

Telerik UI for ASP.NET AJAX File upload and .NET deserialisation exploit (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)

CVE-2019-18935CRITICALunder attackransomware09 Jan 2018

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

100RISK

open ↗

GitHub PoC★ 54

Spectre exploit

CVE-2017-5715MEDIUM09 Jan 2018

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RISK

open ↗

GitHub PoC★ 179

Telerik UI for ASP.NET AJAX File upload and .NET deserialisation exploit (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)

CVE-2017-11317CRITICALunder attack09 Jan 2018

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload

100RISK

open ↗

GitHub PoC★ 11

TwonkyMedia Server 7.0.11-8.5 Directory Traversal CVE-2018-7171

CVE-2018-7171—09 Jan 2018

Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of a

28RISK

open ↗

GitHub PoC★ 9

8.4.1 Jailbreak using CVE-2016-4655 / CVE-2016-4656

CVE-2016-4655MEDIUMunder attack09 Jan 2018

The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

90RISK

open ↗

GitHub PoC

Simply diff for CVE-2017-0785

CVE-2017-0785—07 Jan 2018

A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.

28RISK

open ↗

GitHub PoC★ 1

OSX 10.13.2, CVE-2017-5753, Spectre, PoC, C, ASM for OSX, MAC, Intel Arch, Proof of Concept, Hopper.App Output

CVE-2017-5753MEDIUM07 Jan 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

55RISK

open ↗

GitHub PoC★ 1

Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)

CVE-2017-5753MEDIUM06 Jan 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

55RISK

open ↗

GitHub PoC★ 7

The demo of the speculative execution attack Spectre (CVE-2017-5753, CVE-2017-5715).

CVE-2017-5753MEDIUM06 Jan 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

55RISK

open ↗

GitHub PoC★ 128

Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)

CVE-2017-10271HIGHunder attackransomware05 Jan 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RISK

open ↗

GitHub PoC

A Simple PoC for CVE-2012-4681

CVE-2012-4681CRITICALunder attackransomware05 Jan 2018

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow

100RISK

open ↗

GitHub PoC★ 12

2018年1月2日 (CVE-2017-5753 和 CVE-2017-5715) "幽灵" Spectre 漏洞利用

CVE-2017-5753MEDIUM05 Jan 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

55RISK

open ↗

GitHub PoC

specloli/CVE-2017-17692

CVE-2017-17692—04 Jan 2018

Samsung Internet Browser 5.4.02.3 allows remote attackers to bypass the Same Origin Policy and obtain sensitive informat

60RISK

open ↗

GitHub PoC★ 4

Spectre (CVE-2017-5753) (CVE-2017-5715). Not By Me. Collected from Book.

CVE-2017-5753MEDIUM04 Jan 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

55RISK

open ↗

GitHub PoC★ 773

Example of using revealed "Spectre" exploit (CVE-2017-5753 and CVE-2017-5715)

CVE-2017-5753MEDIUM04 Jan 2018

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of

55RISK

open ↗

GitHub PoC★ 3

forked from https://github.com/s3xy/CVE-2017-10271. Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.Modified by hanc00l

CVE-2017-10271HIGHunder attackransomware03 Jan 2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte

100RISK

open ↗

GitHub PoC★ 2

credit to artkond

CVE-2017-3881CRITICALunder attack02 Jan 2018

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co

100RISK

open ↗

GitHub PoC

Exploit for CVE-2003-0264 based on pwntools and metasploit's windows/reverse_tcp

CVE-2003-0264—01 Jan 2018

Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO arg

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.