Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
initial-access
Telesquare TLR-2005KSH internet.cgi command injection
33RISK
initial-access
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
info-leak
Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection
68RISK
initial-access
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
local
Win32k Elevation of Privilege Vulnerability
100RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
client-side
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
70RISK
local
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
46RISK
initial-access
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute a
43RISK
remote-with-credentials
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio
35RISK
denial-of-service
Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE
50RISK
initial-access
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISK
initial-access
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISK
info-leak
EduSoho < 22.4.7 Arbitrary File Read via classroom-course-statistics
56RISK
info-leak
A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1
98RISK
local
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RISK
initial-access
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
local
Windows CSC Service Elevation of Privilege Vulnerability
41RISK
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
initial-access
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
48RISK
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
initial-access
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
initial-access
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentica
76RISK
initial-access
Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
63RISK
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.