Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits

32,133CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecent popular risk

22,786 exploits

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities

CVE-2018-5754—12 Jun 2018

Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and

23RISK

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities

CVE-2018-5752—12 Jun 2018

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4

23RISK

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities

CVE-2018-5756—12 Jun 2018

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4

23RISK

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities

CVE-2018-5751—12 Jun 2018

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4

23RISK

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities

CVE-2018-5755—12 Jun 2018

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.

23RISK

Exploit-DB

OX App Suite 7.8.4 - Multiple Vulnerabilities

CVE-2017-17062—12 Jun 2018

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4

23RISK

Exploit-DB

Canon PrintMe EFI - Cross-Site Scripting

CVE-2018-12111—12 Jun 2018

Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitra

23RISK

Exploit-DB

WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit)

CVE-2018-11646—11 Jun 2018

webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFavicon

50RISK

Exploit-DB

Schools Alert Management Script - 'get_sec.php' SQL Injection

CVE-2018-12052—11 Jun 2018

SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.

23RISK

Exploit-DB

Schools Alert Management Script - SQL Injection

CVE-2018-12055—11 Jun 2018

Multiple SQL Injections exist in PHP Scripts Mall Schools Alert Management Script via crafted POST data in contact_us.ph

23RISK

Exploit-DB

Schools Alert Management Script - Arbitrary File Read

CVE-2018-12054—11 Jun 2018

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absol

50RISK

Exploit-DB

WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection

CVE-2018-10969—11 Jun 2018

SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute ar

23RISK

Exploit-DB

Schools Alert Management Script - Arbitrary File Deletion

CVE-2018-12053—11 Jun 2018

Arbitrary File Deletion exists in PHP Scripts Mall Schools Alert Management Script via the img parameter in delete_img.p

28RISK

Exploit-DB

WebKit - WebAssembly Compilation Info Leak

CVE-2018-4222—08 Jun 2018

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud

28RISK

Exploit-DB

WebRTC - VP9 Missing Frame Processing Out-of-Bounds Memory Access

CVE-2018-6129—08 Jun 2018

Out of bounds array access in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially per

23RISK

Exploit-DB

Google Chrome - Integer Overflow when Processing WebAssembly Locals

CVE-2018-6092—08 Jun 2018

An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker t

23RISK

Exploit-DB

XiongMai uc-httpd 1.0.0 - Buffer Overflow

CVE-2018-10088—08 Jun 2018

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE

50RISK

Exploit-DB

TrendMicro OfficeScan XG 11.0 - Change Prevention Bypass

CVE-2018-10507—08 Jun 2018

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to take a series of steps to bypass or

23RISK

Exploit-DB

Splunk < 7.0.1 - Information Disclosure

CVE-2018-11409—08 Jun 2018

Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json

60RISK

Exploit-DB

WebKit - Use-After-Free when Resuming Generator

CVE-2018-4218—08 Jun 2018

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud

23RISK

Exploit-DB

WebRTC - VP9 Frame Processing Out-of-Bounds Memory Access

CVE-2018-6130—08 Jun 2018

Incorrect handling of object lifetimes in WebRTC in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to pot

23RISK

Exploit-DB

Monstra CMS < 3.0.4 - Cross-Site Scripting (1)

CVE-2018-10118—07 Jun 2018

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI

23RISK

Exploit-DB

PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow

CVE-2018-7584—06 Jun 2018

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer

45RISK

Exploit-DB

Apple macOS Kernel - Use-After-Free Due to Lack of Locking in nvidia GeForce Driver

CVE-2018-4230—06 Jun 2018

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "NVIDIA Grap

23RISK

Exploit-DB

XNU Kernel - Heap Overflow Due to Bad Bounds Checking in MPTCP

CVE-2018-4241—06 Jun 2018

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

23RISK

Exploit-DB

Apple macOS/iOS Kernel - Heap Overflow Due to Lack of Lower Size Check in getvolattrlist

CVE-2018-4243—06 Jun 2018

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

28RISK

Exploit-DB

WebKit - not_number defineProperties UAF (Metasploit)

CVE-2016-4655MEDIUMunder attack05 Jun 2018

The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

90RISK

Exploit-DB

WebKit - not_number defineProperties UAF (Metasploit)

CVE-2016-4656HIGHunder attack05 Jun 2018

The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denia

91RISK

Exploit-DB

Linux Kernel < 4.16.11 - 'ext4_read_inline_data()' Memory Corruption

CVE-2018-11412—05 Jun 2018

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untruste

28RISK

Exploit-DB

Jenkins Mailer Plugin < 1.20 - Cross-Site Request Forgery (Send Email)

CVE-2018-8718—05 Jun 2018

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.