Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
GetGo Download Manager 6.2.1.3200 - Denial of Service (PoC)
CVE-2017-17849—doswindows25 Jul 2018
A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to exec
28RISK
open ↗
Exploit-DB
Nagios Core 4.4.1 - Denial of Service
CVE-2018-13441—doslinux24 Jul 2018
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows atta
23RISK
open ↗
Exploit-DB
Nagios Core 4.4.1 - Denial of Service
CVE-2018-13457—doslinux24 Jul 2018
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
23RISK
open ↗
Exploit-DB
Nagios Core 4.4.1 - Denial of Service
CVE-2018-13458—doslinux24 Jul 2018
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to
23RISK
open ↗
Exploit-DB
Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)
CVE-2018-12464CRITICALwebappsphp24 Jul 2018
Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway
85RISK
open ↗
Exploit-DB
Micro Focus Secure Messaging Gateway (SMG) < 471 - Remote Code Execution (Metasploit)
CVE-2018-12465CRITICALwebappsphp24 Jul 2018
Remote Code Execution in Micro Focus Secure Messaging Gateway
85RISK
open ↗
Exploit-DB
Davolink DVW 3200 Router - Password Disclosure
CVE-2018-10618—webappshardware23 Jul 2018
Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracke
23RISK
open ↗
Exploit-DB
Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)
CVE-2015-5996—webappshardware23 Jul 2018
Cross-site request forgery (CSRF) vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allo
23RISK
open ↗
Exploit-DB
Inteno’s IOPSYS - (Authenticated) Local Privilege Escalation
CVE-2018-14533—locallinux21 Jul 2018
read_tmp and write_tmp in Inteno IOPSYS allow attackers to gain privileges after writing to /tmp/etc/smb.conf because /v
23RISK
open ↗
Exploit-DB
MSVOD 10 - 'cid' SQL Injection
CVE-2018-14418—webappsphp20 Jul 2018
In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.
23RISK
open ↗
Exploit-DB
Touchpad / Trivum WebTouch Setup 2.53 build 13163 - Authentication Bypass
CVE-2018-13862—webappshardware20 Jul 2018
Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attacker
35RISK
open ↗
Exploit-DB
TP-Link TL-WR840N - Denial of Service
CVE-2018-14336—doshardware20 Jul 2018
TP-Link WR840N devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets w
23RISK
open ↗
Exploit-DB
WordPress Plugin All In One Favicon 4.6 - (Authenticated) Cross-Site Scripting
CVE-2018-13832—webappsphp19 Jul 2018
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plu
23RISK
open ↗
Exploit-DB
MyBB New Threads Plugin 1.1 - Cross-Site Scripting
CVE-2018-14392—webappsphp19 Jul 2018
The New Threads plugin before 1.2 for MyBB has XSS.
35RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux - BPF Sign Extension Local Privilege Escalation (Metasploit)
CVE-2017-16995—locallinux19 Jul 2018
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
50RISK
open ↗
Exploit-DB
Open-AudIT Community 2.1.1 - Cross-Site Scripting
CVE-2018-11124—webappsmultiple18 Jul 2018
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows
23RISK
open ↗
Exploit-DB✓ VexDay Proof
Nanopool Claymore Dual Miner - APIs Remote Code Execution (Metasploit)
CVE-2018-1000049—remotemultiple17 Jul 2018
Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner
60RISK
open ↗
Exploit-DB✓ VexDay Proof
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
CVE-2018-0707—remotelinux17 Jul 2018
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RISK
open ↗
Exploit-DB✓ VexDay Proof
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
CVE-2018-0706—remotelinux17 Jul 2018
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
50RISK
open ↗
Exploit-DB
PrestaShop < 1.6.1.19 - 'BlowFish ECD' Privilege Escalation
CVE-2018-13784—webappsphp16 Jul 2018
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfi
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Fortify Software Security Center (SSC) 17.x/18.1 - XML External Entity Injection
CVE-2018-12463HIGHwebappsjava16 Jul 2018
MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities
46RISK
open ↗
Exploit-DB✓ VexDay Proof
Linux (Ubuntu) - Other Users coredumps Can Be Read via setgid Directory and killpriv Bypass
CVE-2018-13405—doslinux16 Jul 2018
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an
23RISK
open ↗
Exploit-DB
PrestaShop < 1.6.1.19 - 'AES CBC' Privilege Escalation
CVE-2018-13784—webappsphp16 Jul 2018
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfi
28RISK
open ↗
Exploit-DB
VelotiSmart WiFi B-380 Camera - Directory Traversal
CVE-2018-14064—webappshardware16 Jul 2018
The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../..
50RISK
open ↗
Exploit-DB✓ VexDay Proof
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
CVE-2018-0709—webappshardware13 Jul 2018
Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow auth
28RISK
open ↗
Exploit-DB
Grundig Smart Inter@ctive 3.0 - Cross-Site Request Forgery
CVE-2018-13989—webappshardware13 Jul 2018
Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable
23RISK
open ↗
Exploit-DB✓ VexDay Proof
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
CVE-2018-0708—webappshardware13 Jul 2018
Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allo
28RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache CouchDB - Arbitrary Command Execution (Metasploit)
CVE-2017-12635—remotelinux13 Jul 2018
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISK
open ↗
Exploit-DB✓ VexDay Proof
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
CVE-2018-0707—webappshardware13 Jul 2018
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
50RISK
open ↗
Exploit-DB✓ VexDay Proof
WAGO e!DISPLAY 7300T - Multiple Vulnerabilities
CVE-2018-12979—webappsphp13 Jul 2018
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions
23RISK
open ↗
← previouspage 92 / 817next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.