Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
local
CVE-2022-21882HIGHunder attackransomware21 Dec 2023
Win32k Elevation of Privilege Vulnerability
98RISK
initial-access
CVE-2020-1472MEDIUMunder attackransomware21 Dec 2023
Netlogon Elevation of Privilege Vulnerability
100RISK
info-leak
CVE-2017-11882HIGHunder attackransomware21 Dec 2023
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi
100RISK
denial-of-service
CVE-2011-3192—21 Dec 2023
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attac
60RISK
remote-with-credentials
CVE-2021-42278HIGHunder attackransomware21 Dec 2023
Active Directory Domain Services Elevation of Privilege Vulnerability
93RISK
local
CVE-2021-4034HIGHunder attackransomware21 Dec 2023
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
initial-access
CVE-2021-3129CRITICALunder attackransomware21 Dec 2023
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISK
infoleak
CVE-2021-35587CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ver
100RISK
infoleak
CVE-2020-25078HIGHunder attack21 Dec 2023
An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticate
100RISK
infoleak
CVE-2021-43798HIGHunder attack21 Dec 2023
Grafana path traversal
100RISK
client-side
CVE-2018-4878HIGHunder attackransomware21 Dec 2023
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to
93RISK
initial-access
CVE-2020-9496—21 Dec 2023
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
60RISK
infoleak
CVE-2021-43798HIGHunder attack21 Dec 2023
Grafana path traversal
100RISK
infoleak
CVE-2001-0680—21 Dec 2023
Directory traversal vulnerability in ftpd in QPC QVT/Net 4.0 and AVT/Term 5.0 allows a remote attacker to traverse direc
23RISK
client-side
CVE-2021-40444HIGHunder attackransomware21 Dec 2023
Microsoft MSHTML Remote Code Execution Vulnerability
100RISK
initial-access
CVE-2019-5782—21 Dec 2023
Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arb
28RISK
client-side
CVE-2018-2628CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
initial-access
CVE-2020-25223CRITICALunder attack21 Dec 2023
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511
100RISK
client-side
CVE-2020-0601HIGHunder attack21 Dec 2023
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
93RISK
initial-access
CVE-2022-1388CRITICALunder attackransomware21 Dec 2023
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
local
CVE-2011-1249—21 Dec 2023
The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vis
23RISK
local
CVE-2021-1675HIGHunder attackransomware21 Dec 2023
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
initial-access
CVE-2021-44228CRITICALunder attackransomware21 Dec 2023
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
local
CVE-2021-34527HIGHunder attackransomware21 Dec 2023
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
local
CVE-2021-1675HIGHunder attackransomware21 Dec 2023
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
initial-access
CVE-2021-21972CRITICALunder attackransomware21 Dec 2023
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor
100RISK
initial-access
CVE-2021-42013CRITICALunder attackransomware21 Dec 2023
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
initial-access
CVE-2021-42013CRITICALunder attackransomware21 Dec 2023
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
infoleak
CVE-2020-25540—21 Dec 2023
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on
60RISK
initial-access
CVE-2020-2883CRITICALunder attack21 Dec 2023
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th
100RISK
← previouspage 648 / 2,974next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.