Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,859cataloged exploits
32,149CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 19,978GitHub PoC 13,275VulnCheck XDB 8,156Nuclei 4,202Metasploit 3,462✓ verified onlyrecentpopularrisk
13,279 exploits
GitHub PoC★ 2
AstrBot老版本RCE
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key us
41RISK
open ↗GitHub PoC★ 2
CVE-2025-48703 é uma vulnerabilidade de Execução Remota de Código (RCE) no módulo filemanager de um painel de hospedagem web (por exemplo, cPanel). Ocorre devido ao tratamento de entrada não sanitizado na função acc=changePerm, que permite que um atacante injete e execute comandos.
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell
100RISK
open ↗GitHub PoC★ 1
Comprehensive Proof of Concept collection for CVE-2025-11953, CVE-2025-59287, CVE-2025-8941 with exploitation frameworks in Python, C, Bash, PowerShell
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
90RISK
open ↗GitHub PoC
CVE-2025-21042
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitra
76RISK
open ↗GitHub PoC★ 2
Mitchellzhou1/CVE-2024-48910-PoC
DOMPurify vulnerable to tampering by prototype polution
48RISK
open ↗GitHub PoC
CVE-2025-25257 PoC for educational use and/or authorised pentesting.
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗GitHub PoC
Detection for CVE-2025-34299
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
85RISK
open ↗GitHub PoC
Vulnerability for Xwiki
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC
Exploit cyberpanel version 2.3.6 - 2.3.7
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RISK
open ↗GitHub PoC★ 1
check if vulnerable python-django version to CVE-2025-64459 bug
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
53RISK
open ↗GitHub PoC
Exploit and test stand for CVE-2025-2945
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
75RISK
open ↗GitHub PoC
Ghstxz/CVE-2025-32463
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC★ 1
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISK
open ↗GitHub PoC
A proof of concept for CVE-2025-24054/CVE-2025-24071
NTLM Hash Disclosure Spoofing Vulnerability
75RISK
open ↗GitHub PoC★ 12
CVE-2025-6554
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v
71RISK
open ↗GitHub PoC
letsr00t/-CVE-2019-18634-sudo-pwfeedback
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RISK
open ↗GitHub PoC
l1nuxkid/CVE-2025-32433-exploit
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 9
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
85RISK
open ↗GitHub PoC★ 10
Firefox/Tor Browser 0day exploit analysis (CVE-2024-9680) A UAF in animation timelines leading to RCE. Patched.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timeli
83RISK
open ↗GitHub PoC
Tomcat - PUT Method
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RISK
open ↗GitHub PoC★ 1
Emergency Chrome update information and tools for CVE-2023-7024 and other critical vulnerabilities
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit
71RISK
open ↗GitHub PoC★ 1
Emergency Chrome update information and tools for CVE-2023-7024 and other critical vulnerabilities
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit
71RISK
open ↗GitHub PoC★ 4
demo CVE-2019-2215 (Bad Binder) for Android Q
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗GitHub PoC★ 2
This repository contains research notes and a high-level proof-of-concept (PoC) for CVE-2024-21413, a vulnerability observed in certain mail clients when handling SMB/moniker-style links embedded in messages. The PoC and experiments documented here were performed in a controlled lab environment on systems.
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
CVE-2025-54782
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
75RISK
open ↗GitHub PoC
rockmelodies/django_sqli_target_CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
53RISK
open ↗GitHub PoC
A Dockerized setup for running a vulnerable CrushFTP 10 server instance (CVE-2024-4040).
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RISK
open ↗GitHub PoC★ 8
CVE-2025-53690 POC
Sitecore Products ViewState Deserialization Vulnerability
90RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.