Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
Teracue ENC-400 - Command Injection / Missing Authentication
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input direct
28RISK
open ↗Exploit-DB✓ VexDay Proof
Nuuo Central Management - (Authenticated) SQL Server SQL Injection (Metasploit)
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
50RISK
open ↗Exploit-DB
Teracue ENC-400 - Command Injection / Missing Authentication
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de
28RISK
open ↗Exploit-DB✓ VexDay Proof
Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation
Path traversal vulnerability in Filr web application
33RISK
open ↗Exploit-DB
Teracue ENC-400 - Command Injection / Missing Authentication
An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authen
28RISK
open ↗Exploit-DB✓ VexDay Proof
WinRAR 5.61 - Path Traversal
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o
100RISK
open ↗Exploit-DB✓ VexDay Proof
Micro Focus Filr 3.4.0.217 - Path Traversal / Local Privilege Escalation
Local privilege escalation in Filr famtd
41RISK
open ↗Exploit-DB✓ VexDay Proof
MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The so
28RISK
open ↗Exploit-DB✓ VexDay Proof
FaceTime - Texture Processing Memory Corruption
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.
23RISK
open ↗Exploit-DB
HotelDruid 2.3 - Cross-Site Scripting
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabel
43RISK
open ↗Exploit-DB✓ VexDay Proof
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins
60RISK
open ↗Exploit-DB
XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting
XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.
23RISK
open ↗Exploit-DB
XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting
XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discont
23RISK
open ↗Exploit-DB✓ VexDay Proof
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src
60RISK
open ↗Exploit-DB
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon
23RISK
open ↗Exploit-DB
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon
23RISK
open ↗Exploit-DB
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerabi
28RISK
open ↗Exploit-DB✓ VexDay Proof
Jenkins Plugin Script Security < 1.50/Declarative < 1.3.4.1/Groovy < 2.61.1 - Remote Code Execution (PoC)
A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/
60RISK
open ↗Exploit-DB
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userMan
23RISK
open ↗Exploit-DB
Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 - Path Traversal / Cross-Site Scripting
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zon
28RISK
open ↗Exploit-DB
WordPress Plugin WooCommerce - GloBee (cryptocurrency) Payment Gateway 1.1.1 - Payment Bypass / Unauthorized Order Status Spoofing
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
28RISK
open ↗Exploit-DB
MISP 2.4.97 - SQL Command Execution via Command Injection in STIX Module
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped file
28RISK
open ↗Exploit-DB
qdPM 9.1 - 'search[keywords]' Cross-Site Scripting
qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.
38RISK
open ↗Exploit-DB
qdPM 9.1 - 'type' Cross-Site Scripting
qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.
23RISK
open ↗Exploit-DB
Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via l
98RISK
open ↗Exploit-DB
Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload
An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted
23RISK
open ↗Exploit-DB
mIRC < 7.55 - 'Custom URI Protocol Handlers' Remote Command Execution
mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The a
35RISK
open ↗Exploit-DB
Master IP CAM 01 3.3.4.2103 - Remote Command Execution
MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
35RISK
open ↗Exploit-DB
MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / Cross-Site Request Forgery
Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CS
23RISK
open ↗Exploit-DB✓ VexDay Proof
Linux - 'kvm_ioctl_create_device()' NULL Pointer Dereference
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.