Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,900cataloged exploits
36,847CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecentpopularrisk
24,475 exploits
Exploit-DB✓ VexDay Proof
IBM Identity Governance and Intelligence 5.2.3.2 / 5.2.4 - SQL Injection
CVE-2018-1756HIGHwebappsphp12 Sep 2018
IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker co
46RISK
open ↗
Exploit-DB
SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting
CVE-2018-10763—webappswindows12 Sep 2018
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2
23RISK
open ↗
Exploit-DB
SynaMan 4.0 build 1488 - SMTP Credential Disclosure
CVE-2018-10814—webappswindows12 Sep 2018
Synametrics SynaMan 4.0 build 1488 uses cleartext password storage for SMTP credentials.
23RISK
open ↗
Exploit-DB
Apple macOS 10.13.4 - Denial of Service (PoC)
CVE-2018-4240—dosmacos12 Sep 2018
An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Android - 'zygote->init;' Chain from USB Privilege Escalation
CVE-2018-9488—localandroid11 Sep 2018
In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Ghostscript - Failed Restore Command Execution (Metasploit)
CVE-2018-16509—locallinux10 Sep 2018
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handlin
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
CVE-2018-11776HIGHunder attackremotemultiple10 Sep 2018
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullN
100RISK
open ↗
Exploit-DB
QNAP Photo Station 5.7.0 - Cross-Site Scripting
CVE-2018-0715—webappshardware07 Sep 2018
Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inje
23RISK
open ↗
Exploit-DB
Cisco Umbrella Roaming Client 2.0.168 - Local Privilege Escalation
CVE-2018-0438—localwindows_x86-6406 Sep 2018
Cisco Umbrella Enterprise Roaming Client Privilege Escalation Vulnerability
23RISK
open ↗
Exploit-DB
Jorani Leave Management 0.6.5 - Cross-Site Scripting
CVE-2018-15917—webappsphp06 Sep 2018
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HT
38RISK
open ↗
Exploit-DB
Cisco Umbrella Roaming Client 2.0.168 - Local Privilege Escalation
CVE-2018-0437—localwindows_x86-6406 Sep 2018
Cisco Umbrella Enterprise Roaming Client and Enterprise Roaming Module Privilege Escalation Vulnerability
23RISK
open ↗
Exploit-DB
Apache Roller 5.0.3 - XML External Entity Injection (File Disclosure)
CVE-2014-0030—webappslinux06 Sep 2018
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Jorani Leave Management 0.6.5 - (Authenticated) 'startdate' SQL Injection
CVE-2018-15918—webappsphp06 Sep 2018
An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permission
23RISK
open ↗
Exploit-DB
WirelessHART Fieldgate SWG70 3.0 - Directory Traversal
CVE-2018-16059—webappshardware06 Sep 2018
Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename par
43RISK
open ↗
Exploit-DB
Tenda ADSL Router D152 - Cross-Site Scripting
CVE-2018-14497—webappshardware05 Sep 2018
Tenda D152 ADSL routers allow XSS via a crafted SSID.
23RISK
open ↗
Exploit-DB
FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection
CVE-2018-16252—webappswindows03 Sep 2018
FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
23RISK
open ↗
Exploit-DB
D-Link DIR-615 - Denial of Service (PoC)
CVE-2018-15839—doshardware03 Sep 2018
D-Link DIR-615 devices have a buffer overflow via a long Authorization HTTP header.
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Network Manager VPNC 1.2.6 - 'Username' Local Privilege Escalation (Metasploit)
CVE-2018-10900HIGHlocallinux31 Aug 2018
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attac
56RISK
open ↗
Exploit-DB
DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)
CVE-2018-15844—webappsphp31 Aug 2018
An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's pas
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting
CVE-2018-16134—webappswindows_x86-6430 Aug 2018
Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal
CVE-2018-16133—webappswindows_x86-6430 Aug 2018
Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.
50RISK
open ↗
Exploit-DB
DLink DIR-601 - Credential Disclosure
CVE-2018-12710—webappshardware30 Aug 2018
An issue was discovered on D-Link DIR-601 2.02NA devices. Being local to the network and having only "User" account (whi
45RISK
open ↗
Exploit-DB✓ VexDay Proof
phpMyAdmin 4.7.x - Cross-Site Request Forgery
CVE-2017-1000499—webappsphp29 Aug 2018
phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Argus Surveillance DVR 4.0.0.0 - Directory Traversal
CVE-2018-15745—webappswindows_x8629 Aug 2018
Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Microsoft Windows - JScript RegExp.lastIndex Use-After-Free
CVE-2018-8353—doswindows28 Aug 2018
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet
35RISK
open ↗
Exploit-DB✓ VexDay Proof
HP Jetdirect - Path Traversal Arbitrary Code Execution (Metasploit)
CVE-2017-2741—remoteunix27 Aug 2018
A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmwa
60RISK
open ↗
Exploit-DB
RICOH MP C4504ex Printer - Cross-Site Request Forgery (Add Admin)
CVE-2018-15884—webappshardware27 Aug 2018
RICOH MP C4504ex devices allow HTML Injection via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Electron WebPreferences - Remote Code Execution
CVE-2018-15685—remotemultiple27 Aug 2018
GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindow
28RISK
open ↗
Exploit-DB✓ VexDay Proof
WordPress Plugin Plainview Activity Monitor 20161228 - (Authenticated) Command Injection
CVE-2018-15877—webappsphp27 Aug 2018
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISK
open ↗
Exploit-DB✓ VexDay Proof
Adobe Flash - AVC Processing Out-of-Bounds Read
CVE-2018-12827—doslinux27 Aug 2018
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead t
35RISK
open ↗
← previouspage 88 / 816next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.