Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,836cataloged exploits

32,133CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 19,967GitHub PoC 13,264VulnCheck XDB 8,156Nuclei 4,201Metasploit 3,462✓ verified onlyrecent popular risk

13,264 exploits

GitHub PoC★ 1

Proof-of-concept exploit for CVE-2025-55315 (.NET HTTP Request Smuggling). Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulnerable ASP.NET Core/Kestrel servers.

CVE-2025-55315CRITICAL27 Nov 2025

ASP.NET Security Feature Bypass Vulnerability

60RISK

GitHub PoC

yunus-a1i/veeam-cve-2023-27532-mock

CVE-2023-27532HIGHunder attackransomware26 Nov 2025

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database

93RISK

GitHub PoC★ 3

PoC RCE exploit for Nostromo nhttpd ≤ 1.9.6

CVE-2019-16278CRITICALunder attack26 Nov 2025

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RISK

GitHub PoC

OS command injection vulnerability in Samba that received the maximum possible CVSS v3.1 score of 10.0

CVE-2025-10230CRITICAL26 Nov 2025

Samba: command injection in wins server hook script

60RISK

GitHub PoC★ 2

ExtremeUday/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-

CVE-2025-2945CRITICAL26 Nov 2025

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

75RISK

GitHub PoC

CVE-2025-6389

CVE-2025-6389CRITICAL26 Nov 2025

Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback

60RISK

GitHub PoC

Path Traversal Apache HTTP Server 2.4.49/2.4.50

CVE-2021-41773HIGHunder attackransomware26 Nov 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

GitHub PoC

Proof-of-Concept (PoC) for CVE-2025-62168 👾

CVE-2025-62168CRITICAL25 Nov 2025

Squid vulnerable to information disclosure via authentication credential leakage in error handling

75RISK

GitHub PoC★ 31

aklnjakln/CVE-2025-6554

CVE-2025-6554HIGHunder attack25 Nov 2025

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v

71RISK

GitHub PoC★ 2

Tutorial of CVE-2022-37969 with focus on the methodology of Kernel exploitation, not CVE's internal causes

CVE-2022-37969HIGHunder attack25 Nov 2025

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RISK

GitHub PoC★ 2

Reproducing CVE-2024-29943 for Windows, based on https://github.com/bjrjk/CVE-2024-29943

CVE-2024-29943CRITICAL25 Nov 2025

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds chec

53RISK

GitHub PoC

CVE-2025-61757

CVE-2025-61757CRITICALunder attack25 Nov 2025

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers

100RISK

GitHub PoC

CVE-2012-2122 MySQL Authentication Bypass Home Lab

CVE-2012-2122—24 Nov 2025

sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor

60RISK

GitHub PoC

Juniper JunOS J-Web PHP external variable modification (CVE-2023-36845) exploit.

CVE-2023-36845CRITICALunder attack24 Nov 2025

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

GitHub PoC

IS8123/CVE-2025-54381

CVE-2025-54381CRITICAL24 Nov 2025

BentoML is Vulnerable to an SSRF Attack Through File Upload Processing

53RISK

GitHub PoC

CVE-2025-41115

CVE-2025-41115CRITICAL24 Nov 2025

Incorrect privilege assignment

53RISK

GitHub PoC★ 1

A easy poc for CVE-2024-12084.

CVE-2024-12084CRITICAL24 Nov 2025

Rsync: heap buffer overflow in rsync due to improper checksum length handling

70RISK

GitHub PoC

CVE-2025-12762

CVE-2025-12762CRITICAL24 Nov 2025

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

53RISK

GitHub PoC

CVE-2025-11833 Checker

CVE-2025-11833CRITICAL23 Nov 2025

Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure

75RISK

GitHub PoC★ 2

Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure

CVE-2025-24054MEDIUMunder attack23 Nov 2025

NTLM Hash Disclosure Spoofing Vulnerability

75RISK

GitHub PoC★ 1

CVE-2025-10230 PoC - Samba WINS Hook Command Injection

CVE-2025-10230CRITICAL23 Nov 2025

Samba: command injection in wins server hook script

60RISK

GitHub PoC★ 1

This repository contains a full blue-team malware analysis of a real malicious DOCX exploiting CVE-2017-0199. The lab includes sandbox execution, network forensics, IOC extraction, MITRE ATT&CK mapping, dropped files review, and detection rules. Evidence screenshots are included inside the evidence folder for professional documentation.

CVE-2017-0199HIGHunder attackransomware23 Nov 2025

Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window

100RISK

GitHub PoC

rashedhasan090/CVE-2025-5777

CVE-2025-5777CRITICALunder attackransomware23 Nov 2025

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

100RISK

GitHub PoC

ranasen-rat/CVE-2025-11001

CVE-2025-11001HIGH22 Nov 2025

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

46RISK

GitHub PoC

POC

CVE-2025-5777CRITICALunder attackransomware22 Nov 2025

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

100RISK

GitHub PoC★ 4

CVE-2025-26633 (CVSS 7.8) – Zero-day MMC .msc EvilTwin LPE actively exploited by Water Gamayun APT. PoC creates local admin via malicious MSC file on unpatched Windows 10/11/Server. Patched March 2025. Authorized testing only.

CVE-2025-26633HIGHunder attackransomware22 Nov 2025

Microsoft Management Console Security Feature Bypass Vulnerability

83RISK

GitHub PoC★ 7

CVE-2025-11001 (CVSS 7.0) – 7-Zip < 25.00 Directory Traversal → RCE via crafted ZIP with symlink. Allows arbitrary file write when extracted as Administrator. Fixed in 7-Zip 25.00 (July 2025).

CVE-2025-11001HIGH22 Nov 2025

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability

46RISK

GitHub PoC

Custom Docker Image

CVE-2017-7494CRITICALunder attackransomware22 Nov 2025

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo

100RISK

GitHub PoC

Security research tool for detecting and testing CVE-2025-12735 (expr-eval RCE vulnerability)

CVE-2025-12735CRITICAL21 Nov 2025

CVE-2025-12735

48RISK

GitHub PoC★ 4

Oracle Identity Manager 远程代码执行漏洞CVE-2025-61757

CVE-2025-61757CRITICALunder attack21 Nov 2025

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.