Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

85,883cataloged exploits
40,037CVEs with public exploitation
24,696lab-tested
AllReferência 25,956Exploit-DB 24,488GitHub PoC 17,453VulnCheck XDB 9,931Nuclei 4,527Metasploit 3,528✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB✓ VexDay Proof
iOS/macOS 10.13.6 - 'if_ports_used_update_wakeuuid()' 16-byte Uninitialized Kernel Stack Disclosure
CVE-2019-6209—dosmultiple30 Jan 2019
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input
23RISK
open ↗
Exploit-DB
CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass)
CVE-2018-6892—remotewindows_x86-6428 Jan 2019
An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sy
60RISK
open ↗
Exploit-DB
Rundeck Community Edition < 3.0.13 - Persistent Cross-Site Scripting
CVE-2019-6804—webappsjava28 Jan 2019
An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascrip
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Cisco Firepower Management Center 6.2.2.2 / 6.2.3 - Cross-Site Scripting
CVE-2019-1642MEDIUMwebappshardware28 Jan 2019
Cisco Firepower Management Center Cross-Site Scripting Vulnerability
33RISK
open ↗
Exploit-DB
AirTies Air5341 Modem 1.0.0.12 - Cross-Site Request Forgery
CVE-2019-6967—webappshardware28 Jan 2019
AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
28RISK
open ↗
Exploit-DB
LogonBox Limited / Hypersocket Nervepoint Access Manager - (Unauthenticated) Insecure Direct Object Reference
CVE-2019-6716—webappsmultiple28 Jan 2019
An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 thr
23RISK
open ↗
Exploit-DB
MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting
CVE-2019-6979—webappsphp28 Jan 2019
An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the ad
23RISK
open ↗
Exploit-DB
Cisco RV300 / RV320 - Information Disclosure
CVE-2019-1653HIGHunder attackwebappshardware28 Jan 2019
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
100RISK
open ↗
Exploit-DB
Sricam gSOAP 2.8 - Denial of Service
CVE-2019-6973—doshardware28 Jan 2019
Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Cisco RV320 Dual Gigabit WAN VPN Router 1.4.2.15 - Command Injection
CVE-2019-1652HIGHunder attackwebappshardware25 Jan 2019
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Exploit-DB
WordPress Plugin Wisechat 2.6.3 - Reverse Tabnabbing
CVE-2019-6780—webappsphp25 Jan 2019
The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPost
23RISK
open ↗
Exploit-DB✓ VexDay Proof
iOS/macOS - 'task_swap_mach_voucher()' Use-After-Free
CVE-2019-6225—dosmultiple25 Jan 2019
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.
28RISK
open ↗
Exploit-DB
Lua 5.3.5 - 'debug.upvaluejoin' Use After Free
CVE-2019-6706—dosmultiple25 Jan 2019
Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attack
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Ghostscript 9.26 - Pseudo-Operator Remote Code Execution
CVE-2019-6116—remotelinux24 Jan 2019
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to
35RISK
open ↗
Exploit-DB
SirsiDynix e-Library 3.5.x - Cross-Site Scripting
CVE-2018-20503—webappscgi24 Jan 2019
Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.
23RISK
open ↗
Exploit-DB
Zyxel NBG-418N v2 Modem 1.00(AAXM.6)C0 - Cross-Site Request Forgery
CVE-2019-6710—webappshardware24 Jan 2019
Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.
23RISK
open ↗
Exploit-DB
Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation
CVE-2018-15710—webappslinux23 Jan 2019
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
50RISK
open ↗
Exploit-DB
Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation
CVE-2018-15708—webappslinux23 Jan 2019
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP r
60RISK
open ↗
Exploit-DB
GattLib 0.2 - Stack Buffer Overflow
CVE-2019-6498—remotelinux21 Jan 2019
GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.
23RISK
open ↗
Exploit-DB
Linux Kernel 4.13 - 'compat_get_timex()' Leak Kernel Pointer
CVE-2018-11508—doslinux21 Jan 2019
The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitiv
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode' Use-After-Free
CVE-2019-0568—doswindows18 Jan 2019
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISK
open ↗
Exploit-DB
SCP Client - Multiple Vulnerabilities (SSHtranger Things)
CVE-2019-6110MEDIUMremotemultiple18 Jan 2019
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-T
38RISK
open ↗
Exploit-DB
Joomla! Core 3.9.1 - Persistent Cross-Site Scripting in Global Configuration Textfilter Settings
CVE-2019-6263—webappsphp18 Jan 2019
An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allo
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'InitClass' Type Confusion
CVE-2019-0539—doswindows18 Jan 2019
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type Confusion
CVE-2019-0567—doswindows18 Jan 2019
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗
Exploit-DB
Pydio / AjaXplorer < 5.0.4 - (Unauthenticated) Arbitrary File Upload
CVE-2013-6227—webappsphp18 Jan 2019
Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'InlineArrayPush' Type Confusion
CVE-2018-8617—doswindows18 Jan 2019
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISK
open ↗
Exploit-DB
SCP Client - Multiple Vulnerabilities (SSHtranger Things)
CVE-2019-6111MEDIUMremotemultiple18 Jan 2019
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses wh
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type Confusion
CVE-2019-0539—doswindows18 Jan 2019
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗
Exploit-DB✓ VexDay Proof
Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting
CVE-2019-2413—webappsmultiple17 Jan 2019
Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). The s
23RISK
open ↗
← previouspage 76 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.