Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,836cataloged exploits
32,133CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecentpopularrisk
22,786 exploits
Exploit-DB
Werewolf Online 0.8.8 - Information Disclosure
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat outp
23RISK
open ↗Exploit-DB
Bitmain Antminer D3/L3+/S9 - Remote Command Execution
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
28RISK
open ↗Exploit-DB
ClipperCMS 1.3.3 - Cross-Site Scripting
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - 'q' SQL Injection
A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - Cross-Site Scripting
The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - Cross-Site Request Forgery
A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing
23RISK
open ↗Exploit-DB
EasyService Billing 1.0 - Cross-Site Request Forgery
A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= U
23RISK
open ↗Exploit-DB
Oracle WebCenter FatWire Content Server < 7 - Improper Access Control
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Support
23RISK
open ↗Exploit-DB
Skia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks,
28RISK
open ↗Exploit-DB
SAP Internet Transaction Server 6200.x - Session Fixation / Cross-Site Scripting
SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: th
23RISK
open ↗Exploit-DB
Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting
Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported
50RISK
open ↗Exploit-DB
Microsoft Edge Chakra - Cross Context Use-After-Free
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft
35RISK
open ↗Exploit-DB
Honeywell XL Web Controller - Cross-Site Scripting
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earli
23RISK
open ↗Exploit-DB
Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing
A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Ex
23RISK
open ↗Exploit-DB
Siemens SCALANCE S613 - Remote Denial of Service
Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 4
23RISK
open ↗Exploit-DB
Siemens SIMATIC S7-1500 CPU - Remote Denial of Service
Siemens SIMATIC S7-1500 CPU devices with firmware before 1.6 allow remote attackers to cause a denial of service (device
23RISK
open ↗Exploit-DB
Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x
43RISK
open ↗Exploit-DB
MakeMyTrip 7.2.4 - Information Disclosure
An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypte
23RISK
open ↗Exploit-DB
Microsoft Windows - 'POP/MOV SS' Privilege Escalation
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
43RISK
open ↗Exploit-DB
ERPnext 11 - Cross-Site Scripting
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.
23RISK
open ↗Exploit-DB
AMD / ARM / Intel - Speculative Execution Variant 4 Speculative Store Bypass
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres
45RISK
open ↗Exploit-DB
Linux 4.4.0 < 4.4.0-53 - 'AF_PACKET chocobo_root' Local Privilege Escalation (Metasploit)
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
43RISK
open ↗Exploit-DB
Microsoft Edge Chakra JIT - Magic Value Type Confusion
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft
35RISK
open ↗Exploit-DB
Microsoft Internet Explorer 11 (Windows 7 x86/x64) - vbscript Code Execution
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RISK
open ↗Exploit-DB
Linux 2.6.30 < 2.6.36-rc8 - Reliable Datagram Sockets (RDS) Privilege Escalation (Metasploit)
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the
91RISK
open ↗Exploit-DB
Schneider Electric PLCs - Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10
23RISK
open ↗Exploit-DB
ManageEngine Recovery Manager Plus 5.3 - Cross-Site Scripting
A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) all
23RISK
open ↗Exploit-DB
D-Link DSL-3782 - Authentication Bypass
A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 (A1_WI_20170303 || SWVer="V100R001B0
28RISK
open ↗Exploit-DB
Microsoft Edge Chakra JIT - Bound Check Elimination Bug
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
35RISK
open ↗Exploit-DB
DynoRoot DHCP Client - Command Injection
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in
78RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.