Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
24,488 exploits
Exploit-DB
LFCMS 3.7.0 - Cross-Site Request Forgery (Add User)
A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily.
23RISK
open ↗Exploit-DB
LFCMS 3.7.0 - Cross-Site Request Forgery (Add Admin)
Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authen
23RISK
open ↗Exploit-DB
MaDDash 2.0.2 - Directory Listing
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /images/ pr
23RISK
open ↗Exploit-DB
ntp 4.2.8p11 - Local Buffer Overflow (PoC)
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or es
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - Desktop Bridge Virtual Registry CVE-2018-0880 Incomplete Fix Privilege Escalation
An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual regis
23RISK
open ↗Exploit-DB
Redis 5.0 - Denial of Service
Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers t
28RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - Desktop Bridge Activation Arbitrary Directory Creation Privilege Escalation
An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual regis
23RISK
open ↗Exploit-DB
MaDDash 2.0.2 - Directory Listing
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ pro
23RISK
open ↗Exploit-DB
MaDDash 2.0.2 - Directory Listing
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provi
23RISK
open ↗Exploit-DB✓ VexDay Proof
Apache CouchDB < 2.1.0 - Remote Code Execution
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RISK
open ↗Exploit-DB
MaDDash 2.0.2 - Directory Listing
An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provi
23RISK
open ↗Exploit-DB
IPConfigure Orchid VMS 2.0.5 - Directory Traversal / Information Disclosure (Metasploit)
IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
50RISK
open ↗Exploit-DB
Nikto 2.1.6 - CSV Injection
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the S
28RISK
open ↗Exploit-DB
Pale Moon Browser < 27.9.3 - Use After Free (PoC)
A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3.
23RISK
open ↗Exploit-DB
Microsoft COM for Windows - Privilege Escalation
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized
100RISK
open ↗Exploit-DB
Redis-cli < 5.0 - Buffer Overflow (PoC)
Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution
23RISK
open ↗Exploit-DB
Dimofinf CMS 3.0.0 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arb
23RISK
open ↗Exploit-DB
OEcms 3.1 - Cross-Site Scripting
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerabil
38RISK
open ↗Exploit-DB
Joomla! Component Ek Rishta 2.10 - SQL Injection
router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to
23RISK
open ↗Exploit-DB✓ VexDay Proof
glibc - 'realpath()' Privilege Escalation (Metasploit)
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RISK
open ↗Exploit-DB✓ VexDay Proof
DHCP Client - Command Injection 'DynoRoot' (Metasploit)
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in
78RISK
open ↗Exploit-DB✓ VexDay Proof
Microsoft Windows 10 - Child Process Restriction Mitigation Bypass
An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows
23RISK
open ↗Exploit-DB
MACCMS 10 - Cross-Site Request Forgery (Add User)
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
23RISK
open ↗Exploit-DB
RSLinx Classic and FactoryTalk Linx Gateway - Privilege Escalation
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.
23RISK
open ↗Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISK
open ↗Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISK
open ↗Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev4
23RISK
open ↗Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev4
23RISK
open ↗Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev
23RISK
open ↗Exploit-DB
OX App Suite 7.8.4 - Multiple Vulnerabilities
Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.