Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
17,941 exploits
GitHub PoC★ 24
CVE-2025-68428 Proof of Concept
jsPDF has Local File Inclusion/Path Traversal vulnerability
48RISK
open ↗GitHub PoC
Authenticated RCE for Webmin 1.9.0
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Dow
43RISK
open ↗GitHub PoC★ 1
Crime2/poc-CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
71RISK
open ↗GitHub PoC★ 30
CVE-2025-55182-bypass-waf
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Auto exploitation tool for CVE-2024-24401
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payl
60RISK
open ↗GitHub PoC
CVE-2025-14847 PoC exploit for MongoDB heap memory disclosure
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 19
watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691
Upload Arbitrary Files
100RISK
open ↗GitHub PoC★ 1
flame-11/CVE-2025-54068-livewire
Livewire vulnerable to remote command execution during property update hydration
100RISK
open ↗GitHub PoC
alxsourin/Helpdesk-Telecom-CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
53RISK
open ↗GitHub PoC★ 1
Full automation check for CVE-2025-14847 MonogBleed- Finds origin IP and tests for exploit.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 2
CVE-2022-0847（Linux 内核本地提权漏洞）
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC
CVE-2025-55182-poc-json
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
analysis of the sudo buffer overflow affect sudo version <1.8.26 and how to use GCC to compile publicly availible exploits
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RISK
open ↗GitHub PoC★ 1
在python3中运行的脚本
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S
100RISK
open ↗GitHub PoC★ 1
Mass Exploit for CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗GitHub PoC★ 22
CVE-2025-60188 Atarim Plugin Exploit
WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
56RISK
open ↗GitHub PoC
analysis of the sudo buffer overflow affect sudo version <1.8.26 and how to use GCC to compile publicly availible exploits
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RISK
open ↗GitHub PoC
ingress-nginx admission controller RCE escalation PoC
ingress-nginx admission controller RCE escalation
85RISK
open ↗GitHub PoC
DDestinys/CVE-2023-42793
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISK
open ↗GitHub PoC
CVE-2025-55182, also known as React2Shell, is a critical vulnerability affecting Next.js applications using React Server Components (RSC) and Server Actions.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 1
CVE-2025-14847 MongoDB Memory Leak Exploit
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
nishant-kumar-5173/CVE-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
85RISK
open ↗GitHub PoC
"Once upon a time, the Castle of Reactland trusted all Flight messages... until The Imposter arrived." A storytelling CVE-2025-55182 (React2Shell) demo - Medieval-themed vulnerable React Server Components app for security education.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 1
Exploit for the CVE-2025-37164
A remote code execution issue exists in HPE OneView.
100RISK
open ↗GitHub PoC★ 2
Nextjs RCE Exploit
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 79
exploit for cve-2025-43529
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
76RISK
open ↗GitHub PoC
zsy107u/CVE-2025-2011-poc
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
68RISK
open ↗GitHub PoC★ 1
CVE-2025-52691 Scanner - Detects vulnerable SmarterMail installations (CVSS 10.0 RCE)
Upload Arbitrary Files
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.