Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

72,018cataloged exploits

32,219CVEs with public exploitation

1,932lab-tested

All Exploit-DB 22,786Referência 20,023GitHub PoC 13,334VulnCheck XDB 8,195Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

13,334 exploits

GitHub PoC

This repository provides an in-depth analysis of the Log4Shell vulnerability (CVE-2021-44228) and implements a machine learning-based approach to detect exploitation attempts in log data.

CVE-2021-44228CRITICALunder attackransomware17 Feb 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

skrkcb2/CVE-2025-0851

CVE-2025-0851CRITICAL17 Feb 2025

Path traversal issue in Deep Java Library

53RISK

GitHub PoC

sariamubeen/CVE-2024-10924

CVE-2024-10924CRITICAL17 Feb 2025

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISK

GitHub PoC★ 1

This Proof of Concept (PoC) demonstrates the exploitation of the CVE-2024-4367 vulnerability, which involves Cross-Site Scripting (XSS) attacks.

CVE-2024-4367MEDIUM17 Feb 2025

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RISK

GitHub PoC★ 3

sariamubeen/CVE-2023-7028

CVE-2023-7028CRITICALunder attack17 Feb 2025

Weak Password Recovery Mechanism for Forgotten Password in GitLab

100RISK

GitHub PoC

This repository contains a Python script to exploit two vulnerabilities: CVE-2019-18818 and CVE-2019-19609.

CVE-2019-18818—16 Feb 2025

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

60RISK

GitHub PoC★ 43

CVE-2025-24016: Wazuh Unsafe Deserialization Remote Code Execution (RCE)

CVE-2025-24016CRITICALunder attack16 Feb 2025

Remote code execution in Wazuh server

100RISK

GitHub PoC

ModeBrutal/CVE-2024-5084-Auto-Exploit

CVE-2024-5084CRITICAL16 Feb 2025

Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

75RISK

GitHub PoC★ 9

POC for CVE-2024-42327: Zabbix Privilege Escalation -> RCE

CVE-2024-42327CRITICAL16 Feb 2025

SQL injection in user.get API

70RISK

GitHub PoC

Explore CVE-2023-33580 (XSS) & CVE-2023-33584 (SQLI) discovered by me. Dive into vulnerabilities and exploits for insights.

CVE-2023-33580—16 Feb 2025

Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" f

23RISK

GitHub PoC

hopsypopsy8/CVE-2020-1938-Exploitation

CVE-2020-1938CRITICALunder attack15 Feb 2025

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISK

GitHub PoC★ 1

Browser exploitation framework for Chakra (Edge). Written as part of OSEE preparation. Demo bug: CVE-2019-0567

CVE-2019-0567—15 Feb 2025

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

45RISK

GitHub PoC★ 2

A Proof-of-Concept (PoC) exploit for CVE-2024-10924, a vulnerability in the Really Simple SSL WordPress plugin that allows bypassing two-factor authentication (2FA). Includes mitigation techniques to secure affected WordPress sites.

CVE-2024-10924CRITICAL14 Feb 2025

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISK

GitHub PoC

php-cgi-cve-2024-4577

CVE-2024-4577CRITICALunder attackransomware14 Feb 2025

Argument Injection in PHP-CGI

100RISK

GitHub PoC

Didarul342/CVE-2024-4577

CVE-2024-4577CRITICALunder attackransomware14 Feb 2025

Argument Injection in PHP-CGI

100RISK

GitHub PoC★ 8

PoC exploit for CVE-2025-0108 - PAN-OS Authentication Bypass

CVE-2025-0108HIGHunder attack14 Feb 2025

PAN-OS: Authentication Bypass in the Management Web Interface

100RISK

GitHub PoC★ 32

Palo Alto Networks PAN-OS 身份验证绕过漏洞批量检测脚本(CVE-2025-0108)

CVE-2025-0108HIGHunder attack13 Feb 2025

PAN-OS: Authentication Bypass in the Management Web Interface

100RISK

GitHub PoC

CVE-2016-6914-UniFiVideo-LPE

CVE-2016-6914—13 Feb 2025

Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local u

23RISK

GitHub PoC★ 1

This Proof of Concept (PoC) demonstrates an exploit for CVE-2024-42009, leveraging a cross-site scripting (XSS) vulnerability to extract emails from a target webmail application. The attack injects a malicious payload that exfiltrates email content to an attacker-controlled listener.

CVE-2024-42009CRITICALunder attack13 Feb 2025

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea

100RISK

GitHub PoC

luke0x90/CVE-2021-21551

CVE-2021-21551HIGHunder attack13 Feb 2025

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

98RISK

GitHub PoC

CMS Made Simple < 2.2.10 - SQL Injection python3

CVE-2019-9053—13 Feb 2025

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISK

GitHub PoC

Apache Struts CVE-2024-53677 Exploitation

CVE-2024-53677CRITICAL13 Feb 2025

Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

70RISK

GitHub PoC★ 2

POC for Roundcube vulnerabilities CVE-2024-42008 and CVE-2024-42010

CVE-2024-42008CRITICAL13 Feb 2025

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7

60RISK

GitHub PoC★ 4

huseyinstif/CVE-2025-24016-Nuclei-Template

CVE-2025-24016CRITICALunder attack13 Feb 2025

Remote code execution in Wazuh server

100RISK

GitHub PoC

Modified exploit for CVE-2021-43798 compatible with both Windows and Linux hosts.

CVE-2021-43798HIGHunder attack12 Feb 2025

Grafana path traversal

100RISK

GitHub PoC

qnole000/CVE-2024-51378

CVE-2024-51378CRITICALunder attackransomware12 Feb 2025

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t

100RISK

GitHub PoC

An unauthenticated attacker can force server points to a shell file like ‘/bin/sh’ and execute arbitrary commands due to the failure in verifying the URL which leads to path traversal to any file that exists in the system. Nostromo’s versions such as 1.9.6 fail to verify this URL

CVE-2019-16278CRITICALunder attack12 Feb 2025

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

100RISK

GitHub PoC

Active Exploitation of Atlassian’s Questions for Confluence App CVE-2022-26134

CVE-2022-26134CRITICALunder attackransomware12 Feb 2025

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

GitHub PoC★ 2

demonstriert, wie mittels missbräuchlicher Nutzung eines Swap-Cookies eine VPN-Session übernommen werden kann. Wichtig: Dieses Projekt dient ausschliesslich zu Bildungs- und Forschungszwecken – bitte nur in Umgebungen verwenden, in denen Du explizit authorisiert bist.

CVE-2024-53704HIGHunder attackransomware11 Feb 2025

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authe

100RISK

GitHub PoC★ 1

yenyangmjaze/cve-2024-10914

CVE-2024-10914CRITICAL11 Feb 2025

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.