Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
local
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISK
remote-with-credentials
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RISK
local
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISK
initial-access
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
78RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
initial-access
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RISK
initial-access
Path traversal vulnerability in WinRAR
93RISK
remote-with-credentials
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISK
initial-access
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RISK
local
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISK
remote-with-credentials
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RISK
remote-with-credentials
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISK
initial-access
FUXA Unauthenticated Remote Arbitrary Scheduler Write
68RISK
remote-with-credentials
Libblockdev: lpe from allow_active to root in libblockdev via udisks
41RISK
remote-with-credentials
20RISK
denial-of-service
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many
93RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
remote-with-credentials
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
53RISK
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
initial-access
Simple File List < 4.2.3 - Remote Code Execution
75RISK
client-side
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.