Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,001cataloged exploits

40,084CVEs with public exploitation

24,696lab-tested

All Referência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecent popular risk

24,488 exploits

Exploit-DB

Brother HL Series Printers 1.15 - Cross-Site Scripting

CVE-2018-11581—webappshardware04 Jun 2018

Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web s

23RISK

Exploit-DB

EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting

CVE-2018-11628—webappsaspx04 Jun 2018

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malici

23RISK

Exploit-DB

SearchBlox 8.6.7 - XML External Entity Injection

CVE-2018-11586—webappsjava04 Jun 2018

XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to re

28RISK

Exploit-DB

Zip-n-Go 4.9 - Buffer Overflow (SEH)

CVE-2018-16302—localwindows04 Jun 2018

MediaComm Zip-n-Go before 4.95 has a Buffer Overflow via a crafted file.

23RISK

Exploit-DB

GreenCMS 2.3.0603 - Cross-Site Request Forgery / Remote Code Execution

CVE-2018-11670—webappsphp03 Jun 2018

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary

23RISK

Exploit-DB

GreenCMS 2.3.0603 - Cross-Site Request Forgery (Add Admin)

CVE-2018-11671—webappsphp03 Jun 2018

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php

23RISK

Exploit-DB✓ VexDay Proof

Microsoft Edge Chakra - EntrySimpleObjectSlotGetter Type Confusion

CVE-2018-8133—doswindows31 May 2018

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

35RISK

Exploit-DB

Procps-ng - Multiple Vulnerabilities

CVE-2018-1123LOWlocallinux30 May 2018

procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection

28RISK

Exploit-DB

Procps-ng - Multiple Vulnerabilities

CVE-2018-1122HIGHlocallinux30 May 2018

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset

41RISK

Exploit-DB

Procps-ng - Multiple Vulnerabilities

CVE-2018-1124HIGHlocallinux30 May 2018

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec

41RISK

Exploit-DB

Procps-ng - Multiple Vulnerabilities

CVE-2018-1121LOWlocallinux30 May 2018

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() return

28RISK

Exploit-DB

Procps-ng - Multiple Vulnerabilities

CVE-2018-1120LOWlocallinux30 May 2018

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory

28RISK

Exploit-DB✓ VexDay Proof

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass

CVE-2018-6409—webappsphp30 May 2018

An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path fr

28RISK

Exploit-DB

Yosoro 1.0.4 - Remote Code Execution

CVE-2018-11522—webappsmacos30 May 2018

Yosoro 1.0.4 has stored XSS.

23RISK

Exploit-DB✓ VexDay Proof

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass

CVE-2018-6411—webappsphp30 May 2018

An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically

23RISK

Exploit-DB✓ VexDay Proof

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass

CVE-2018-6410—webappsphp30 May 2018

An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.

23RISK

Exploit-DB

Siemens SIMATIC S7-300 CPU - Remote Denial of Service

CVE-2015-2177HIGHdoslinux30 May 2018

Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via craf

53RISK

Exploit-DB✓ VexDay Proof

Dolibarr ERP/CRM 7.0.0 - (Authenticated) SQL Injection

CVE-2018-10094—webappsphp30 May 2018

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vecto

50RISK

Exploit-DB

SearchBlox 8.6.6 - Cross-Site Request Forgery

CVE-2018-11538—webappsjava30 May 2018

servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST param

28RISK

Exploit-DB

Sitemakin SLAC 1.0 - 'my_item_search' SQL Injection

CVE-2018-11535—webappsphp29 May 2018

An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.

23RISK

Exploit-DB

NUUO NVRmini2 / NVRsolo - Arbitrary File Upload

CVE-2018-11523—webappshardware29 May 2018

upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.

23RISK

Exploit-DB

MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting

CVE-2018-11532—webappsphp29 May 2018

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonst

23RISK

Exploit-DB

DomainMod 4.09.03 - 'oid' Cross-Site Scripting

CVE-2018-11403—webappsphp28 May 2018

DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.

23RISK

Exploit-DB

wityCMS 0.6.1 - Cross-Site Scripting

CVE-2018-11512—webappsphp28 May 2018

Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "Ge

23RISK

Exploit-DB

DomainMod 4.09.03 - 'sslpaid' Cross-Site Scripting

CVE-2018-11404—webappsphp28 May 2018

DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.

23RISK

Exploit-DB

Werewolf Online 0.8.8 - Information Disclosure

CVE-2018-11505—localandroid27 May 2018

The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat outp

23RISK

Exploit-DB

Bitmain Antminer D3/L3+/S9 - Remote Command Execution

CVE-2018-11220—remotehardware27 May 2018

Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.

28RISK

Exploit-DB

ClipperCMS 1.3.3 - Cross-Site Scripting

CVE-2018-11332—webappsphp27 May 2018

Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in

23RISK

Exploit-DB

EasyService Billing 1.0 - Cross-Site Request Forgery

CVE-2018-11442—webappsphp26 May 2018

A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= U

23RISK

Exploit-DB

EasyService Billing 1.0 - Cross-Site Request Forgery

CVE-2018-11445—webappsphp26 May 2018

A CSRF issue was discovered on the User Add/System Settings Page (system-settings-user-new2.php) in EasyService Billing

23RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.