Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,464cataloged exploits

40,695CVEs with public exploitation

24,696lab-tested

All Referência 26,426Exploit-DB 24,489GitHub PoC 18,182VulnCheck XDB 10,251Nuclei 4,577Metasploit 3,539✓ verified onlyrecent popular risk

18,080 exploits

GitHub PoC★ 2

Information about my advisory on CVE-2006-3747 (Apache mod_rewrite LDAP off-by-one buffer overflow).. At the time, it was the first public working exploit :)

CVE-2006-3747—26 Nov 2016

Off-by-one error in the ldap scheme handling in the Rewrite module (mod_rewrite) in Apache 1.3 from 1.3.28, 2.0.46 and o

60RISK

GitHub PoC★ 932

Dirty Cow exploit - CVE-2016-5195

CVE-2016-5195HIGHunder attack25 Nov 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 25

NTPD remote DOS exploit and vulnerable container

CVE-2016-7434—22 Nov 2016

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a craf

35RISK

GitHub PoC★ 10

这里保留着部分脏牛漏洞的利用代码

CVE-2016-5195HIGHunder attack17 Nov 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

bluebluelan/CVE-2015-7547-proj-master

CVE-2015-7547—10 Nov 2016

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C

45RISK

GitHub PoC★ 7

Exploit for Joomla 3.4.4 - 3.6.4 (CVE-2016-8869 and CVE-2016-8870)

CVE-2016-8869—10 Nov 2016

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before

60RISK

GitHub PoC

Recent Linux privilege escalation exploit

CVE-2016-5195HIGHunder attack06 Nov 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

Source code: https://github.com/XiphosResearch/exploits/tree/master/Joomraa

CVE-2016-8869—02 Nov 2016

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before

60RISK

GitHub PoC★ 5

firebroo/CVE-2016-6663

CVE-2016-6663—02 Nov 2016

Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB be

23RISK

GitHub PoC

hittlle/CVE-2011-1974-PoC

CVE-2011-1974—01 Nov 2016

NDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2 and SP3 and Windows Serve

23RISK

GitHub PoC★ 6

oleg-fiksel/ansible_CVE-2016-5195_check

CVE-2016-5195HIGHunder attack29 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 16

Scan vuls kernel CVE-2016-5195 - DirtyCow

CVE-2016-5195HIGHunder attack29 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

Check the Browser's FlashPlayer version to check if it is vulnerable to exploit CVE-2016-7855

CVE-2016-7855HIGHunder attack26 Oct 2016

Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linu

76RISK

GitHub PoC★ 32

Universal Android root tool based on CVE-2016-5195. Watch this space.

CVE-2016-5195HIGHunder attack24 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 341

A CVE-2016-5195 exploit example.

CVE-2016-5195HIGHunder attack23 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 510

PoC for Dirty COW (CVE-2016-5195)

CVE-2016-5195HIGHunder attack22 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 10

Mitigates CVE-2016-5195 aka DirtyCOW

CVE-2016-5195HIGHunder attack22 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 7

Dirty COW (CVE-2016-5195) vulnerability testing utility for Linux-based systems.

CVE-2016-5195HIGHunder attack22 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 1,018

CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android

CVE-2016-5195HIGHunder attack21 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 1

ASRTeam/CVE-2016-5195

CVE-2016-5195HIGHunder attack21 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

Dirty Cow

CVE-2016-5195HIGHunder attack21 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

Ansible playbook to mitigate CVE-2016-5195 on CentOS

CVE-2016-5195HIGHunder attack21 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 13

CVE-2016-5195 exploit written in Crystal

CVE-2016-5195HIGHunder attack21 Oct 2016

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC

Proof-of-Concept CVE-2016-0199

CVE-2016-0199—16 Oct 2016

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service

35RISK

GitHub PoC★ 1

Reproducible exploits for: CVE-2016-1240 CVE-2008-2938 CVE-2014-2064 CVE-2014-1904

CVE-2016-1240—13 Oct 2016

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

38RISK

GitHub PoC★ 1

Reproducible exploits for: CVE-2016-1240 CVE-2008-2938 CVE-2014-2064 CVE-2014-1904

CVE-2008-2938—13 Oct 2016

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16,

60RISK

GitHub PoC★ 102

OS X 10.11.6 LPE PoC for CVE-2016-4655 / CVE-2016-4656

CVE-2016-4655MEDIUMunder attack02 Oct 2016

The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

90RISK

GitHub PoC

just some research notes

CVE-2015-3864—30 Sep 2016

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A

60RISK

GitHub PoC★ 27

CVE-2016-2776

CVE-2016-2776—30 Sep 2016

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly

60RISK

GitHub PoC

KosukeShimofuji/CVE-2016-2776

CVE-2016-2776—28 Sep 2016

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly

60RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.