The Exploit Database
The Exploit Database (EDB) – an ultimate archive of exploits and vulnerable software. A great resource for penetration testers, vulnerability researchers, and security addicts alike. Our aim is to collect exploits from submittals and mailing lists and concentrate them in one, easy to navigate database.
Remote Exploits
| Date | D | Description | Plat. | Author | |
|---|---|---|---|---|---|
| 2025-06-05 |
|
Apache Tomcat 10.1.39 - Denial of Service (DoS) | 10 | REMOTE | Abdualhadi khalifa |
| 2025-06-05 |
|
ABB Cylon Aspect 3.08.04 DeploySource - Remote Code Execution (RCE) | 6 | REMOTE | LiquidWorm |
| 2025-06-05 |
|
Microsoft Windows Server 2025 JScript Engine - Remote Code Execution (RCE) | 9 | REMOTE | Mohammed Idrees Banyamer |
| 2025-06-05 |
|
Grandstream GSD3710 1.0.11.13 - Stack Overflow | 4 | REMOTE | Pepelux |
| 2025-05-29 |
|
SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal | 6 | REMOTE | İbrahimsql |
| 2025-05-29 |
|
Windows File Explorer Windows 11 (23H2) - NTLM Hash Disclosure | 3 | REMOTE | Mohammed Idrees Banyamer |
| 2025-05-29 |
|
Automic Agent 24.3.0 HF4 - Privilege Escalation | 8 | REMOTE | Flora Schäfer |
| 2025-05-29 |
|
Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass | 3 | REMOTE | İbrahimsql |
| 2025-05-25 |
|
ABB Cylon Aspect 3.08.03 - Guest2Root Privilege Escalation | 5 | REMOTE | LiquidWorm |
| 2025-05-25 |
|
Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow | 5 | REMOTE | Pepelux |
Local Exploits
| Date | D | Description | Plat. | Author | |
|---|---|---|---|---|---|
| 2025-06-05 |
|
macOS LaunchDaemon iOS 17.2 - Privilege Escalation | 5 | LOCAL | Mohammed Idrees Banyamer |
| 2025-05-25 |
|
ABB Cylon Aspect Studio 3.08.03 - Binary Planting | 2 | LOCAL | LiquidWorm |
| 2025-05-25 |
|
Microsoft Windows Server 2016 - Win32k Elevation of Privilege | 3 | LOCAL | Milad karimi |
| 2025-05-18 |
|
Zyxel USG FLEX H series uOS 1.31 - Privilege Escalation | 3 | LOCAL | Marco Ivaldi |
| 2025-05-13 |
|
TP-Link VN020 F3v(T) TT_V6.2.1021) - DHCP Stack Buffer Overflow | 4 | LOCAL | Mohamed Maatallah |
| 2025-05-13 |
|
RDPGuard 9.9.9 - Privilege Escalation | 5 | LOCAL | Ahmet Ümit BAYRAM |
| 2025-05-09 |
|
VirtualBox 7.0.16 - Privilege Escalation | 3 | LOCAL | Milad karimi |
| 2025-05-09 |
|
Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege | 3 | LOCAL | Milad karimi |
| 2025-05-01 |
|
Microsoft - NTLM Hash Disclosure Spoofing (library-ms) | 5 | LOCAL | hyp3rlinx |
| 2025-05-01 |
|
ZTE ZXV10 H201L - RCE via authentication bypass | 4 | LOCAL | tasos meletlidis |
Web Applications
| Date | D | Description | Plat. | Author | |
|---|---|---|---|---|---|
| 2025-06-05 | |
CloudClassroom PHP Project 1.0 - SQL Injection | 6 | WEB | Sanjay Singh |
| 2025-05-29 | |
Campcodes Online Hospital Management System 1.0 - SQL Injection | 4 | WEB | Carine Constantino |
| 2025-05-29 | |
WordPress Digits Plugin 8.4.6.1 - Authentication Bypass via OTP Bruteforcing | 4 | WEB | Saleh Tarawneh |
| 2025-05-25 | |
Java-springboot-codebase 1.1 - Arbitrary File Read | 4 | WEB | d3sca |
| 2025-05-25 | |
WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass | 3 | WEB | Mohammed Idrees Banyamer |
| 2025-05-13 | |
WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escala | 4 | WEB | Md Shoriful Islam |
| 2025-05-13 | |
Kentico Xperience 13.0.178 - Cross Site Scripting (XSS) | 3 | WEB | Alex Messham |
| 2025-05-09 | |
SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation | 4 | WEB | Abdualhadi khalifa |
| 2025-05-09 | |
WordPress Depicter Plugin 3.6.1 - SQL Injection | 4 | WEB | Andrew Long |
| 2025-05-06 | |
ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF) | 4 | WEB | Ahmed Thaiban |
DoS/PoC
| Date | D | Description | Plat. | Author | |
|---|---|---|---|---|---|
| 2024-08-28 | |
Windows TCP/IP - RCE Checker and Denial of Service | 3 | DOS | Photubias |
| 2024-03-28 | |
RouterOS 6.40.5 - 6.44 and 6.48.1 - 6.49.10 - Denial of Service | 2 | DOS | ice-wzl |
| 2024-02-26 | |
Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' | 2 | DOS | hyp3rlinx |
| 2024-02-19 | |
XAMPP - Buffer Overflow POC | 3 | DOS | Talson |
| 2024-02-13 | |
VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) - Remote Denial Of Service | 3 | DOS | LiquidWorm |
| 2024-02-09 | |
Elasticsearch - StackOverflow DoS | 3 | DOS | TOUHAMI Kasbaoui |
| 2024-02-02 | |
Electrolink FM/DAB/TV Transmitter - Unauthenticated Remote DoS | 3 | DOS | LiquidWorm |
| 2023-10-09 | |
OpenPLC WebServer 3 - Denial of Service | 2 | DOS | Kai Feng |
| 2023-10-09 | |
Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service | 3 | DOS | LiquidWorm |
| 2023-09-08 | |
SyncBreeze 15.2.24 - 'login' Denial of Service | 3 | DOS | mohamed youssef |
Shellcode
| Date | D | Description | Plat. | Author | |
|---|---|---|---|---|---|
| 2025-05-21 | |
Windows 11 x64 - Reverse TCP Shellcode (564 bytes) | 4 | SHELLCODE | Victor Huerlimann |
| 2025-05-21 | |
Linux/x86 - Reverse TCP Shellcode (95 bytes) | 4 | SHELLCODE | Al Baradi Joy |
| 2025-05-21 | |
Linux/x86-64 - execve(_/bin/sh_) Shellcode (36 bytes) | 4 | SHELLCODE | Sayan Ray |
| 2023-09-08 | |
Windows/x64 - PIC Null-Free TCP Reverse Shell Shellcode (476 Bytes) | 1 | SHELLCODE | Senzee |
| 2023-08-21 | |
Linux/x64 - memfd_create ELF loader Shellcode (170 bytes) | 1 | SHELLCODE | Ivan Nikolsky |
| 2023-07-28 | |
Windows/x64 - PIC Null-Free Calc.exe Shellcode (169 Bytes) | 2 | SHELLCODE | Senzee |
| 2023-04-25 | |
Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode | 1 | SHELLCODE | Nayani |
| 2023-04-05 | |
Linux/x86_64 - bash Shellcode with xor encoding | 0 | SHELLCODE | Jeenika Anadani |
| 2023-04-03 | |
Windows/x86 - Create Administrator User / Dynamic PEB & EDT method null-free She | 1 | SHELLCODE | Xavi Beltran |
| 2023-04-01 | |
FlipRotation v1.0 decoder - Shellcode (146 bytes) | 1 | SHELLCODE | Eduardo Silva |
Papers
| Date | D | Description | Plat. | Author | |
|---|---|---|---|---|---|
| 2018-11-16 | |
The Powerful Resource of PHP Stream Wrappers | 610 | PAPERS | Netsparker |
| 2018-11-01 | |
Phrack: Viewer Discretion Advised: (De)coding an iOS Kernel Vulnerability (Adam | 553 | PAPERS | phrack |
| 2018-10-09 | |
A Red Teamer’s guide to pivoting | 457 | PAPERS | Artem Kondratenko |
| 2018-10-08 | |
Phrack: Twenty years of Escaping the Java Sandbox (Ieu Eauvidoum & disk noise) | 1489 | PAPERS | phrack |
| 2018-01-15 | |
Phrack: .NET Instrumentation via MSIL bytecode injection (Antonio "s4tan" Parata | 1363 | PAPERS | phrack |
| 2017-08-28 | |
Abusing Token Privileges For LPE | 846 | PAPERS | drone and breenmachine |
| 2017-01-12 | |
OpenSSL - Weak KDF | 942 | PAPERS | anonymous |
| 2014-08-27 | |
SSDP Amplification Scanner | 707 | PAPERS | SaMaN |
| 2014-06-26 | |
[Hacking-Contest] SSH Server wrapper | 664 | PAPERS | Jakob Lell |
| 2012-03-20 | |
Full MSSQL Injection PWNage | 864 | PAPERS | CWH Underground |