Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
13,307 exploits
GitHub PoC
Proof of Concept (PoC) script for CVE-2025-24813, vulnerability in Apache Tomcat.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC
airtiels 5650 CVE-2015-2797 PoC
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 502
60RISK
open ↗GitHub PoC
Attacks a vulnerable WordPress site with the wp-automatic plugin. Inserts a new user called eviladmin directly into the database (INSERT INTO wp_users). Searches for the ID of the newly created user (cyclic SELECT). Promotes eviladmin to Administrator (INSERT INTO wp_usermeta).
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC★ 12
Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
WHS3기 가상화 취약한(CVE) Docker 환경 구성 과제
ingress-nginx admission controller RCE escalation
85RISK
open ↗GitHub PoC
ChoDeokCheol/CVE-2023-39361
Unauthenticated SQL Injection in graph_view.php in Cacti
85RISK
open ↗GitHub PoC
romanedutov/CVE-2025-2294
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RISK
open ↗GitHub PoC★ 2
CVE-2021-42287/CVE-2021-42278/OTHER Scanner & Exploiter.
Active Directory Domain Services Elevation of Privilege Vulnerability
93RISK
open ↗GitHub PoC★ 10
CraftCMS RCE Checker (CVE-2025-32432)
Craft CMS Allows Remote Code Execution
100RISK
open ↗GitHub PoC★ 2
Next.js middleware bypass exploit
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
A PoC of CVE-2016-10033 I made for PentesterLab
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗GitHub PoC★ 5
Proof-of-Concept (PoC) for CVE-2025-29306, a Remote Code Execution vulnerability in FoxCMS. This Python script scans single or multiple targets, executes commands, and reports vulnerable hosts.
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗GitHub PoC
K4Der11000/k4_cve-2023-41064
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1
76RISK
open ↗GitHub PoC
Python Proof of Concept for CVE-2023-1545 (SQL Injection for Teampass versions prior to 3.0.0.23).
SQL Injection in nilsteampassnet/teampass
41RISK
open ↗GitHub PoC★ 1
Erlang OTP SSH NSE Discovery Script
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC
WonderCMS v3.4.2 NSE Discovery Script
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code
60RISK
open ↗GitHub PoC
A PoC of CVE-2016-2098 I made for PentesterLab
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to e
60RISK
open ↗GitHub PoC★ 3
CVE-2025-32433 Erlang/OTP SSH RCE Exploit SSH远程代码执行漏洞EXP
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 4
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
A PoC of CVE-2019-5420 I made for PentesterLab
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess th
60RISK
open ↗GitHub PoC
A PoC of CVE-2018-0114 I made for PentesterLab
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker
35RISK
open ↗GitHub PoC★ 1
tar-fs file write/overwrite vulnerability
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted
41RISK
open ↗GitHub PoC
CVE-2025-31161 python exploit
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISK
open ↗GitHub PoC
Commvault CVE-2025-34028 endpoint scanner using Nmap NSE. For ethical testing and configuration validation.
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RISK
open ↗GitHub PoC★ 3
Analysis of the Reproduction of CVE-2025-30208 Series Vulnerabilities
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC
unzip-stream file write/overwrite vulnerability
Arbitrary File Write via artifact extraction in actions/artifact
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.