Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
80,646cataloged exploits
37,382CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 23,825GitHub PoC 15,392VulnCheck XDB 9,029Nuclei 4,416Metasploit 3,502✓ verified onlyrecentpopularrisk
80,646 exploits
VulnCheck XDB
initial-access
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
open ↗VulnCheck XDB
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 1
CVE-2023-5360 PoC: Unauthenticated arbitrary file upload leading to RCE in Royal Elementor Addons (≤ 1.3.78), written in pure Python.
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
60RISK
open ↗VulnCheck XDB
initial-access
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because fun
75RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 1
flame-11/CVE-2018-9206-jquery-file-upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
open ↗GitHub PoC★ 36
MongoDB CVE-2025-14847 Heap Memory Leak Scanner | OP_COMPRESSED zlib Vulnerability | Bug Bounty & Red Team Tool
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
KingHacker353/CVE-2025-14847_Expolit
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 2
golang test tool for mongobleed (cve-2025-14847)
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
saereya/CVE-2025-14847---MongoBleed
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 31
a critical memory disclosure vulnerability in MongoDB's zlib compression handling. This tool allows security researchers to extract sensitive data from vulnerable MongoDB instances.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗VulnCheck XDB
initial-access
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
60RISK
open ↗GitHub PoC
This is a standalone Python implementation for CVE-2024-46506. I created this script because I could only find the Metasploit module and needed a lightweight, portable version that doesn't require the full Metasploit Framework.
NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because fun
75RISK
open ↗GitHub PoC★ 1
PoC For CVE-2024-30167 (Atlona OME Authenticated Command Injection)
/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary comm
33RISK
open ↗GitHub PoC★ 3
PoC para determinar si Fortinet es vulnerable a CVE-2025-59718 / CVE-2025-59719
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0
90RISK
open ↗GitHub PoC★ 3
A testing framework to identify and demonstrate deserialization vulnerabilities in LangChain Core (<0.3.81). Educational use only
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
60RISK
open ↗GitHub PoC
Dlanang/homelab-CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC
The minor methodology for room: https://tryhackme.com/room/n8ncve202568613
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC★ 1
Khin-96/n8n-cve-2025-68613-thm
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC★ 1
CVE-2025-68613 (n8n) Critical RCE analysis + defensive recommendations (patch validation, detection ideas, and hardening tips)
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC★ 7
This laboratory provides a controlled environment to analyze and reproduce CVE-2025-68613 in a vulnerable n8n instance.
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
KirolosKhairy/CVE-2023-27372
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗VulnCheck XDB
infoleak
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗VulnCheck XDB
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RISK
open ↗VulnCheck XDB
infoleak
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 1
Mass Bot Exploit
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 8
CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE 0day Finder Quick
Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid paramete
53RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.