Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
18,020 exploits
GitHub PoC★ 10
Python tool for safe archive handling, path traversal awareness, and secure extraction. Inspired by CVE-2025-8088.
Path traversal vulnerability in WinRAR
93RISK
open ↗GitHub PoC
BiiTts/POC-IngressNightmare-CVE-2025-1974
ingress-nginx admission controller RCE escalation
85RISK
open ↗GitHub PoC
kylew1004/cve-2017-5941-poc-docker-lab
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RISK
open ↗GitHub PoC★ 6
POC for CVE-2025-4404
Freeipa: idm: privilege escalation from host to domain admin in freeipa
48RISK
open ↗GitHub PoC
TryHackMe CTF writeup — WordPress RCE via CVE-2024-25600, crypto miner forensics, and LockBit ransomware group identification
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗GitHub PoC
RAJMadhusankha/Shellshock-CVE-2014-6271-Exploitation-and-Analysis
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC
A POC for CVE-2025-24893 written in python
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 4
POC exploit for CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 6
This vulnerability could allow a malicious user to execute remote code by sending appropriately crafted requests to the default search engine SolrSearch
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 26
This CVE addresses a vulnerability in sudo versions 1.9.14 to 1.9.17, enabling unauthorized local privilege escalation to root access.
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC
This repository contains a completely original and self-developed Proof-of-Concept (PoC) for CVE-2018-7600, also known as Drupalgeddon 2 — a critical remote code execution vulnerability affecting Drupal 7 and 8 core versions.
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC★ 26
This CVE addresses a vulnerability in sudo versions 1.9.14 to 1.9.17, enabling unauthorized local privilege escalation to root access.
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC
XWiki 15.10.11, 16.4.1 and 16.5.0RC1 Unauthenticated Remote code execution POC
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 2
Exploit demonstrating an authentication bypass vulnerability in the web interface of Belkin F9K1009 and F9K1010 routers.
Belkin F9K1009/F9K1010 Web Interface hard-coded credentials
48RISK
open ↗GitHub PoC
一个由AI生成的漏洞验证应用
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC
Scouserr/cve-2022-0847-poc-dockerimage
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC
MingqiZhang7710/cve-2022-0847-poc-dockerimage
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC★ 1
Th3Gl0w/CVE-2025-24893-POC
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 1
PoC to inject a command via the DEVICE_PING endpoint
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect Advanced
46RISK
open ↗GitHub PoC★ 5
Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (CVE-2025-34152)
Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter
85RISK
open ↗GitHub PoC
Agampreet-Singh/CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
CVE-2025-24893 is a critical unauthenticated remote code execution (RCE) vulnerability in XWiki, a popular open-source enterprise wiki platform.
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 5
soltanali0/CVE-2025-5777-Exploit
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC
Bash POC script for RCE vulnerability in XWiki Platform
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 1
🔒 Spring4Shell Firewall Defense — Cybersecurity Incident Simulation This project is part of a Cybersecurity Job Simulation I completed in August 2025 through Forage. It focuses on detecting, analyzing, and mitigating a simulated real-world cyberattack involving the Spring4Shell (CVE-2022-22965) vulnerability
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗GitHub PoC
POC for CVE-2021-35448 based on https://www.exploit-db.com/exploits/49601
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using
23RISK
open ↗GitHub PoC★ 1
Automated scanner + exploit for CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 1
Simulated PoC for CVE-2025-54253: Adobe AEM OGNL Injection Vulnerability
Adobe Experience Manager | Incorrect Authorization (CWE-863)
100RISK
open ↗GitHub PoC
esmwaSpyware/DoS-PoC-for-CVE-2020-0796-SMBGhost-
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.