Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,682cataloged exploits
39,953CVEs with public exploitation
24,696lab-tested
AllReferência 25,887Exploit-DB 24,488GitHub PoC 17,378VulnCheck XDB 9,888Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
SolarWinds DameWare Mini Remote Control 10.0 - Denial of Service
CVE-2019-9017—doswindows03 May 2019
DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size field for the m
28RISK
open ↗
Exploit-DB
Zotonic < 0.47.0 mod_admin - Cross-Site Scripting
CVE-2019-11504—webappsmultiple03 May 2019
Zotonic before version 0.47 has mod_admin XSS.
23RISK
open ↗
Exploit-DB
WordPress Plugin Social Warfare < 3.5.3 - Remote Code Execution
CVE-2019-9978MEDIUMunder attackwebappsphp03 May 2019
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RISK
open ↗
Exploit-DB
Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow - Remote Command Injection
CVE-2019-3929CRITICALunder attackwebappshardware03 May 2019
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Ba
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
CVE-2019-5420—remotelinux02 May 2019
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RISK
open ↗
Exploit-DB
CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting
CVE-2019-11429—webappslinux01 May 2019
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro)
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Domoticz 4.10577 - Unauthenticated Remote Command Execution
CVE-2019-10664—webappsmultiple30 Apr 2019
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux - Missing Locking Between ELF coredump code and userfaultfd VMA Modification
CVE-2019-11599—doslinux30 Apr 2019
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma la
23RISK
open ↗
Exploit-DB
Moodle 3.6.3 - 'Install Plugin' Remote Command Execution (Metasploit)
CVE-2019-11631—remotephp30 Apr 2019
35RISK
open ↗
Exploit-DB
HumHub 1.3.12 - Cross-Site Scripting
CVE-2019-11564—webappsphp30 Apr 2019
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HT
23RISK
open ↗
Exploit-DB
Spring Cloud Config 2.1.x - Path Traversal (Metasploit)
CVE-2019-3799—webappsjava30 Apr 2019
Directory Traversal with spring-cloud-config-server
60RISK
open ↗
Exploit-DB✓ VexDay Proof
AIS logistics ESEL-Server - Unauthenticated SQL Injection Remote Code Execution (Metasploit)
CVE-2019-10123—remotewindows30 Apr 2019
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app)
50RISK
open ↗
Exploit-DB✓ VexDay Proof
Domoticz 4.10577 - Unauthenticated Remote Command Execution
CVE-2019-10678—webappsmultiple30 Apr 2019
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.
28RISK
open ↗
Exploit-DB
DeviceViewer 3.12.0.1 - 'user' SEH Overflow
CVE-2019-11563—localwindows30 Apr 2019
20RISK
open ↗
Exploit-DB✓ VexDay Proof
Pimcore < 5.71 - Unserialize Remote Code Execution (Metasploit)
CVE-2019-10867—remotephp30 Apr 2019
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/c
50RISK
open ↗
Exploit-DB
Intelbras IWR 3000N - Denial of Service (Remote Reboot)
CVE-2019-11415—doshardware30 Apr 2019
An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause
28RISK
open ↗
Exploit-DB
Intelbras IWR 3000N 1.5.0 - Cross-Site Request Forgery
CVE-2019-11416—webappshardware30 Apr 2019
A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstr
23RISK
open ↗
Exploit-DB
Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution
CVE-2019-2725HIGHunder attackransomwarewebappswindows30 Apr 2019
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
100RISK
open ↗
Exploit-DB
Apache Pluto 3.0.0 / 3.0.1 - Persistent Cross-Site Scripting
CVE-2019-0186—webappsjava26 Apr 2019
The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XS
28RISK
open ↗
Exploit-DB✓ VexDay Proof
systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process
CVE-2019-3844MEDIUMdoslinux26 Apr 2019
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of
33RISK
open ↗
Exploit-DB✓ VexDay Proof
systemd - DynamicUser can Create setuid Binaries when Assisted by Another Process
CVE-2019-3843MEDIUMdoslinux26 Apr 2019
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
33RISK
open ↗
Exploit-DB✓ VexDay Proof
RARLAB WinRAR 5.61 - ACE Format Input Validation Remote Code Execution (Metasploit)
CVE-2018-20250HIGHunder attackransomwarelocalwindows25 Apr 2019
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗
Exploit-DB
JioFi 4G M2S 1.0.2 - 'mask' Cross-Site Scripting
CVE-2019-7438—webappshardware25 Apr 2019
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.
23RISK
open ↗
Exploit-DB
JioFi 4G M2S 1.0.2 - Denial of Service
CVE-2019-7439—doshardware25 Apr 2019
cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices allows a DoS (Hang) via the mask POST parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
VirtualBox 6.0.4 r128413 - COM RPC Interface Code Injection Host Privilege Escalation
CVE-2019-2721—localwindows24 Apr 2019
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th
23RISK
open ↗
Exploit-DB✓ VexDay Proof
systemd - Lack of Seat Verification in PAM Module Permits Spoofing Active Session to polkit
CVE-2019-3842MEDIUMdoslinux23 Apr 2019
In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
33RISK
open ↗
Exploit-DB
UliCMS 2019.2 / 2019.1 - Multiple Cross-Site Scripting
CVE-2019-11398—webappsphp22 Apr 2019
Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitra
23RISK
open ↗
Exploit-DB
QNAP myQNAPcloud Connect 1.3.4.0317 - 'Username/Password' Denial of Service
CVE-2019-7181—doshardware22 Apr 2019
Buffer Overflow vulnerability in myQNAPcloud Connect 1.3.3.0925 and earlier could allow remote attackers to crash the pr
23RISK
open ↗
Exploit-DB
Msvod 10 - Cross-Site Request Forgery (Change User Information)
CVE-2019-11375—webappsphp22 Apr 2019
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.
23RISK
open ↗
Exploit-DB
74CMS 5.0.1 - Cross-Site Request Forgery (Add New Admin User)
CVE-2019-11374—webappsphp22 Apr 2019
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
23RISK
open ↗
← previouspage 69 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.