Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
72,018cataloged exploits
32,219CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,023GitHub PoC 13,334VulnCheck XDB 8,195Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
71,957 exploits
VulnCheck XDB
denial-of-service
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle req
100RISK
open ↗VulnCheck XDB
initial-access
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗VulnCheck XDB
initial-access
The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to
23RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Asus Router Arbitrary File Write to Remote Code Execution PoC - Fk Mirai
ASUS Router - Upload arbitrary firmware
48RISK
open ↗GitHub PoC
this is a metasploit exploit module for CVE-2024-25096 and CVE-2023-3452
Canto <= 3.0.4 - Unauthenticated Remote File Inclusion
63RISK
open ↗GitHub PoC
Full-cycle Pentest on Metasploitable (VMware/Kali). Scanned services (Apache Tomcat/8180), researched CVE-2002-0936 via Exploit-DB, and gained access using default creds (Metasploit). Performed local enumeration for SUID misconfigs, exploiting a legacy Nmap binary to escalate privileges to Root.
The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the w
28RISK
open ↗GitHub PoC
luoqichen/CVE-2025-55182-POC
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
CVE-2014-6271
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗Metasploit300
AVideo Unauthenticated SQL Injection Credential Dump
WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
43RISK
open ↗GitHub PoC★ 2
yonathanpy/CVE-2025-32462-CVE-2025-32463-PoC-Lab
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allo
28RISK
open ↗VulnCheck XDB
local
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RISK
open ↗GitHub PoC
shakyanayann/CVE-2022-0185
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RISK
open ↗Metasploit600
AVideo Encoder getImage.php Unauthenticated Command Injection
AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php
43RISK
open ↗VulnCheck XDB
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗VulnCheck XDB
remote-with-credentials
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗VulnCheck XDB
initial-access
Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability
63RISK
open ↗GitHub PoC
prabeershakya/CVE-2022-0185-POC
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RISK
open ↗GitHub PoC★ 1
Technical analysis and proof-of-concept for CVE-2024-1086, a Linux kernel nf_tables use-after-free vulnerability leading to local privilege escalation. Includes vulnerability breakdown, affected versions, exploitation methodology, and mitigation guidance for research and educational purposes.
Use-after-free in Linux kernel's netfilter: nf_tables component
76RISK
open ↗GitHub PoC
arrhenius975/CVE-2024-38063-Exploit-Refactoring
Windows TCP/IP Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC★ 1
Faridi-m/CVE-2021-22911-RocketChat
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗GitHub PoC
CVE-2023-3452 exploit for WordPress Canto plugin RCE, HTTPS support included
Canto <= 3.0.4 - Unauthenticated Remote File Inclusion
63RISK
open ↗GitHub PoC
CVE-2025-32463
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC★ 1
Demonstrate a proof-of-concept exploit for CVE-2026-2441, a high-risk Chrome use-after-free vulnerability in the Blink CSS engine.
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside
76RISK
open ↗Exploit-DB
WordPress Backup Migration 1.3.7 - Remote Command Execution
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
85RISK
open ↗Exploit-DB
Boss Mini v1.4.0 - Local File Inclusion (LFI)
Boss Mini document file inclusion
78RISK
open ↗GitHub PoC
CVE-2025-68613 — n8n RCE via Expression Injection
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.