Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,426cataloged exploits
41,291CVEs with public exploitation
24,696lab-tested
AllReferência 26,792Exploit-DB 24,491GitHub PoC 18,666exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,309 exploits
infoleak
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio
100RISK
initial-access
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp
100RISK
initial-access
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
68RISK
client-side
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
75RISK
local
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
infoleak
WordPress Core < 6.2.1 - Directory Traversal
70RISK
infoleak
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow re
100RISK
local
Path traversal vulnerability in WinRAR
93RISK
initial-access
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
68RISK
denial-of-service
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold an
100RISK
initial-access
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RISK
initial-access
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
initial-access
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
remote-with-credentials
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
78RISK
initial-access
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to s
60RISK
local
Windows SMB Client Elevation of Privilege Vulnerability
93RISK
initial-access
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
infoleak
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
local
Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_
23RISK
client-side
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit
76RISK
client-side
Path traversal vulnerability in WinRAR
93RISK
local
Windows Agere Modem Driver Elevation of Privilege Vulnerability
71RISK
local
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
46RISK
initial-access
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISK
initial-access
Perfect Survey < 1.5.2 - Unauthenticated SQL Injection
60RISK
initial-access
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RISK
client-side
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v
76RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.