Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,589cataloged exploits
34,508CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,554GitHub PoC 13,689VulnCheck XDB 8,216Nuclei 4,223Metasploit 3,464✓ verified onlyrecentpopularrisk
13,687 exploits
GitHub PoC★ 25
Ivanti EPM SQL Injection Remote Code Execution Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗GitHub PoC★ 4
jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗GitHub PoC
Rejetto http File Server 2.3.x (Reverse shell)
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC
raytran54/CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
Basic POC to test CVE-2024-3094 vulnerability inside K8s cluster
Xz: malicious code in distributed source
70RISK
open ↗GitHub PoC
CVE-2022-36446 POC 실습
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗GitHub PoC★ 4
NanoWraith/CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 29
CVE-2024-37051 poc and exploit
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
48RISK
open ↗GitHub PoC
PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
feely666/CVE-2024-1086
Use-after-free in Linux kernel's netfilter: nf_tables component
76RISK
open ↗GitHub PoC★ 1
Vulnerability check script for CVE-2024-37393 (SecurEnvoy MFA 9.4.513)
Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-suppl
63RISK
open ↗GitHub PoC
paradox0909/cve-2022-30333_online_rar_extracor
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
100RISK
open ↗GitHub PoC★ 90
Veeam Backup Enterprise Manager Authentication Bypass (CVE-2024-29849)
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
53RISK
open ↗GitHub PoC★ 3
Objective: Demonstrate the exploitation of the Log4Shell vulnerability (CVE-2021-44228) within a simulated banking application environment.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 16
POC - CVE-2024–4956 - Nexus Repository Manager 3 Unauthenticated Path Traversal
Nexus Repository 3 - Path Traversal
61RISK
open ↗GitHub PoC★ 9
POC - CVE-2024–24919 - Check Point Security Gateways
Information disclosure
100RISK
open ↗GitHub PoC★ 10
A PoC exploit for CVE-2024-4577 - PHP CGI Argument Injection Remote Code Execution (RCE)
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 12
Authentication Bypass Vulnerability — CVE-2024–4358 — Telerik Report Server 2024
Registration Authentication Bypass Vulnerability
100RISK
open ↗GitHub PoC★ 3
itzheartzz/MASS-CVE-2024-27956
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC
J4F9S5D2Q7/CVE-2023-43208-MIRTHCONNECT
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that
100RISK
open ↗GitHub PoC
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
68RISK
open ↗GitHub PoC★ 9
Proof Of Concept RCE exploit for critical vulnerability in PHP <8.2.15 (Windows), allowing attackers to execute arbitrary commands.
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 164
[漏洞复现] 全球首款利用PHP默认环境（XAMPP）的CVE-2024-4577 PHP-CGI RCE 漏洞 EXP。
Argument Injection in PHP-CGI
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.