Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,634cataloged exploits
40,286CVEs with public exploitation
24,696lab-tested
AllReferência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecentpopularrisk
17,941 exploits
GitHub PoC
🎯 Automated vulnerability scanner for React2Shell RCE - Google dorking + safe detection for CVE-2025-55182/CVE-2025-66478 (CVSS 10.0)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
This repository provides a proof-of-concept for CVE-2025-55182 (React2Shell), a remote code execution vulnerability in React Server Components. It demonstrates how the exploit works, including the payload and impact.
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
amirali-ramezani/react2shell-CVE-2025-55182-
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 1
aexdyhaxor/CVE-2025-32463
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC
CVE-2025-14611 CentreStack and Triofox full Poc/Exploit
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RISK
open ↗GitHub PoC
Rishi-kaul/n8n-CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC
Context-Aware Memory Leak Scanner & Exploit for CVE-2025-14847.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 3
CVE-2025-14847 (MongoBleed)
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
MongoBleed: CVE-2025-14847 Memory Leak Discovery Tool
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
Detect exposed MongoDB instances and CVE-2025-14847 "MongoBleed" risks — Zero-Trust Python scanner
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 4
Academic proof-of-concept demonstrating CVE-2025-14847 for authorized security research.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 13
Exploit lab, docker and code scanner for mongobleed Vulnerability CVE-2025-14847 plus Phoenix Security Sync tools
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 1
CVE-2025-14847 – MongoDB Unauthenticated Memory‑Leak Exploit
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
Reproducible Docker lab for CVE-2018-15133 (Laravel Framework token unserialize RCE)
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISK
open ↗GitHub PoC★ 2
AntonieSoga/Erlang-OTP-PoC_CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC
cv-sai-kamesh/n8n-CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC
hariskhalil555000-sketch/What-utility-does-CVE-2024-3094-refer-to-
Xz: malicious code in distributed source
70RISK
open ↗GitHub PoC★ 3
Explot, Lab, Scanner - external and docker container, for SMongobleed-CVE-2025-14847 plus phoenix security uploader
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
n8n CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗GitHub PoC
The script focuses on safe artifact acquisition first, followed by optional on-host analysis, and produces a portable, hashed forensic archive suitable for offline investigation on a forensic workstation.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
bodoinon/CVE-2024-10924
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RISK
open ↗GitHub PoC
CVE-2025-20393
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
90RISK
open ↗GitHub PoC★ 2
Proof of Concept for CVE-2025-24893 demonstrating unauthenticated remote command execution in XWiki through unsafe server-side template evaluation.
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 1
PoC For CVE-2024-30167 (Atlona OME Authenticated Command Injection)
/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary comm
33RISK
open ↗GitHub PoC
webmin/usermin 2.100
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid
48RISK
open ↗GitHub PoC★ 3
A testing framework to identify and demonstrate deserialization vulnerabilities in LangChain Core (<0.3.81). Educational use only
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
60RISK
open ↗GitHub PoC
KingHacker353/R2C-CVE-2025-55182-66478
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 31
a critical memory disclosure vulnerability in MongoDB's zlib compression handling. This tool allows security researchers to extract sensitive data from vulnerable MongoDB instances.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 2
golang test tool for mongobleed (cve-2025-14847)
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
saereya/CVE-2025-14847---MongoBleed
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.