Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,447cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,218Metasploit 3,464✓ verified onlyrecentpopularrisk
72,030 exploits
GitHub PoC
OS command injection vulnerability in Samba that received the maximum possible CVSS v3.1 score of 10.0
Samba: command injection in wins server hook script
60RISK
open ↗GitHub PoC
yunus-a1i/veeam-cve-2023-27532-mock
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database
93RISK
open ↗GitHub PoC★ 2
ExtremeUday/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
75RISK
open ↗GitHub PoC
Path Traversal Apache HTTP Server 2.4.49/2.4.50
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC
CVE-2025-6389
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
60RISK
open ↗VulnCheck XDB
initial-access
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co
100RISK
open ↗GitHub PoC★ 3
PoC RCE exploit for Nostromo nhttpd ≤ 1.9.6
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co
100RISK
open ↗VulnCheck XDB
client-side
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v
71RISK
open ↗VulnCheck XDB
initial-access
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
60RISK
open ↗Metasploit300
GeoServer WMS GetMap XXE Arbitrary File Read
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
98RISK
open ↗GitHub PoC★ 31
aklnjakln/CVE-2025-6554
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v
71RISK
open ↗GitHub PoC
CVE-2025-61757
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported vers
100RISK
open ↗GitHub PoC
Proof-of-Concept (PoC) for CVE-2025-62168 👾
Squid vulnerable to information disclosure via authentication credential leakage in error handling
75RISK
open ↗GitHub PoC★ 2
Tutorial of CVE-2022-37969 with focus on the methodology of Kernel exploitation, not CVE's internal causes
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RISK
open ↗VulnCheck XDB
local
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RISK
open ↗GitHub PoC★ 2
Reproducing CVE-2024-29943 for Windows, based on https://github.com/bjrjk/CVE-2024-29943
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds chec
53RISK
open ↗VulnCheck XDB
initial-access
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗VulnCheck XDB
local
7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability
46RISK
open ↗VulnCheck XDB
infoleak
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the con
60RISK
open ↗GitHub PoC
CVE-2012-2122 MySQL Authentication Bypass Home Lab
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befor
60RISK
open ↗GitHub PoC
IS8123/CVE-2025-54381
BentoML is Vulnerable to an SSRF Attack Through File Upload Processing
53RISK
open ↗GitHub PoC
Juniper JunOS J-Web PHP external variable modification (CVE-2023-36845) exploit.
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗GitHub PoC
CVE-2025-12762
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
53RISK
open ↗GitHub PoC★ 1
A easy poc for CVE-2024-12084.
Rsync: heap buffer overflow in rsync due to improper checksum length handling
70RISK
open ↗GitHub PoC★ 1
CVE-2025-10230 PoC - Samba WINS Hook Command Injection
Samba: command injection in wins server hook script
60RISK
open ↗GitHub PoC
CVE-2025-11833 Checker
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
75RISK
open ↗GitHub PoC★ 2
Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure
NTLM Hash Disclosure Spoofing Vulnerability
75RISK
open ↗GitHub PoC
rashedhasan090/CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.