Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits

32,133CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecent popular risk

13,264 exploits

GitHub PoC★ 798

CVE-2025-55182 POC

CVE-2025-55182CRITICALunder attackransomware03 Dec 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC

sudlit/CVE-2017-7494

CVE-2017-7494CRITICALunder attackransomware02 Dec 2025

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

100RISK

open ↗

GitHub PoC★ 1

PoC for testing CVE-2025-29927 for Next.js versions 11.x, 12.x <= 12.3.5, 13.x <= 13.5.9, 14.x <=14.2.25, 15.x <= 15.2.3

CVE-2025-29927CRITICAL02 Dec 2025

Authorization Bypass in Next.js Middleware

85RISK

open ↗

GitHub PoC★ 1

Jorge2Rubio/CVE-2019-0232

CVE-2019-0232—02 Dec 2025

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RISK

open ↗

GitHub PoC

boro03/CVE-2021-4034

CVE-2021-4034HIGHunder attack02 Dec 2025

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

open ↗

GitHub PoC

Vulnerable environment for testing CVE-2021-22941 Nuclei template

CVE-2021-22941CRITICALunder attackransomware02 Dec 2025

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacke

90RISK

open ↗

GitHub PoC

This repo contain a PoC I have done when blind analysis the dbutil_2_3.sys driver for vulnerability. This was created by personal analysis without looking at writeups or even know which CVE exist in this driver. All the knowledge I have is that this driver is vulnerable in some way.

CVE-2021-21551HIGHunder attack02 Dec 2025

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

98RISK

open ↗

GitHub PoC

towaos/towaos-lab-cve-2020-11023

CVE-2020-11023MEDIUMunder attack02 Dec 2025

Potential XSS vulnerability in jQuery

85RISK

open ↗

GitHub PoC★ 2

Vulnerability: SQL Injection via QuerySet and Q() keyword argument unpacking. CVE ID: CVE-2025-64459 Severity: Critical (CVSS 9.1) Affected Versions: Django 5.1 < 5.1.14, 4.2 < 4.2.26, and 5.2 < 5.2.8. Researcher: Cyberstan (University of Warwick)

CVE-2025-64459CRITICAL01 Dec 2025

Potential SQL injection via _connector keyword argument in QuerySet and Q objects

53RISK

open ↗

GitHub PoC

letsr00t/CVE-2013-2094

CVE-2013-2094HIGHunder attack01 Dec 2025

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t

83RISK

open ↗

GitHub PoC★ 8

Reverse engineering research and custom firmware for the Allwinner V3-based SJCAM SJ4000 Air, including firmware parsers, an AVIOCTRL client, security research, and the CVE-2026-52656 proof of concept.

CVE-2026-52656CRITICAL01 Dec 2025

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an a

48RISK

open ↗

GitHub PoC★ 11

Outlook exploitation

CVE-2024-21413CRITICALunder attack30 Nov 2025

Microsoft Outlook Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC

sec-dojo-com/CVE-2020-24186

CVE-2020-24186CRITICAL29 Nov 2025

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

GitHub PoC

xi0onamdev/WinRAR-CVE-2025-8088-Exploitation-Toolkit

CVE-2025-8088HIGHunder attack29 Nov 2025

Path traversal vulnerability in WinRAR

93RISK

open ↗

GitHub PoC

KylVGoi/cve-2019-1663

CVE-2019-1663CRITICAL29 Nov 2025

Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability

85RISK

open ↗

GitHub PoC★ 1

m2hcz/CVE-2025-6440-Poc-Exploit

CVE-2025-6440CRITICAL29 Nov 2025

WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload

60RISK

open ↗

GitHub PoC

CVE-2018-10933 - LibSSH - Authentication Bypass

CVE-2018-10933CRITICAL29 Nov 2025

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul

85RISK

open ↗

GitHub PoC

Exploit - CVE-2023-26360

CVE-2023-26360HIGHunder attack28 Nov 2025

Adobe ColdFusion Improper Access Control Arbitrary code execution

100RISK

open ↗

GitHub PoC

AndrewMas99/CVE-2019-11043-Vulnerability

CVE-2019-11043HIGHunder attackransomware28 Nov 2025

Underflow in PHP-FPM can lead to RCE

100RISK

open ↗

GitHub PoC

CVE-2010-2075

CVE-2010-2075—28 Nov 2025

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally

60RISK

open ↗

GitHub PoC

Modified the CVE-2024-25600

CVE-2024-25600CRITICAL28 Nov 2025

WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

85RISK

open ↗

GitHub PoC

CVE-2021-43798 is a high-severity path traversal vulnerability (CVSS 3.1 score: 7.5) affecting Grafana versions 8.0.0-beta1 through 8.3.0. It allows unauthenticated attackers to read arbitrary files from the server by exploiting improper sanitization in the /public/plugins/:pluginId endpoint

CVE-2021-43798HIGHunder attack27 Nov 2025

Grafana path traversal

100RISK

open ↗

GitHub PoC

CVE-2025-58360

CVE-2025-58360HIGHunder attack27 Nov 2025

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

98RISK

open ↗

GitHub PoC★ 6

XXE through a specific endpoint /geoserver/wms operation GetMap - Geoserver

CVE-2025-58360HIGHunder attack27 Nov 2025

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

98RISK

open ↗

GitHub PoC★ 1

Proof-of-concept exploit for CVE-2025-55315 (.NET HTTP Request Smuggling). Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulnerable ASP.NET Core/Kestrel servers.

CVE-2025-55315CRITICAL27 Nov 2025

ASP.NET Security Feature Bypass Vulnerability

60RISK

open ↗

GitHub PoC

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

CVE-2025-32433CRITICALunder attack27 Nov 2025

Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

100RISK

open ↗

GitHub PoC

Chroot Privilege Escalation

CVE-2025-32463CRITICALunder attack27 Nov 2025

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

100RISK

open ↗

GitHub PoC

TeamCity 2023.05.3 - CVE-2023-42793 - Create username administrator.

CVE-2023-42793CRITICALunder attackransomware27 Nov 2025

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RISK

open ↗

GitHub PoC★ 4

Secure expression evaluator - Drop-in replacement for expr-eval without CVE-2025-12735 vulnerability

CVE-2025-12735CRITICAL27 Nov 2025

CVE-2025-12735

48RISK

open ↗

GitHub PoC★ 1

CVE-2017-0144

CVE-2017-0144HIGHunder attackransomware27 Nov 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.