Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
18,020 exploits
GitHub PoC
Checks projects for compromised packages, suspicious files, and import statements.
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Inst
71RISK
open ↗GitHub PoC
Detect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Inst
71RISK
open ↗GitHub PoC
Proof-of-Concept exploit for CVE-2025-32429 (SQL Injection in PHP PDO prepared statements) – for educational and security research purposes only
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
85RISK
open ↗GitHub PoC★ 3
This document describes a Denial of Service (DoS) vulnerability found in certain versions of MikroTik RouterOS. The vulnerability is due to insufficient handling of crafted SMB requests. A remote attacker could exploit this issue by sending a specially crafted request to the target server.
Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (devic
41RISK
open ↗GitHub PoC
elprogramadorgt/CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗GitHub PoC
This is my implementation of shellshock exploit
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC
Report written on CVE-2024-38112
Windows MSHTML Platform Spoofing Vulnerability
93RISK
open ↗GitHub PoC
Honeypot for CVE-2025-53770 aka ToolShell
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 10
Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm).
XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter
85RISK
open ↗GitHub PoC
G01d3nW01f/cve-2023-27372
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗GitHub PoC
Just a quick script I cooked up to exploit CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
Udyz/CVE-2025-53770-Exploit
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
Ather-Energy/POC-CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC
Detection rules for CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 4
This is a exploit for the known Remote Code Execution (RCE) vulnerability in the `pymatgen` (CVE-2024-23346) Python library by uploading a malicious `CIF` file to the hosted `CIF Analyzer` website on the target running on the Chemistry machine from Hack the Box.
pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
48RISK
open ↗GitHub PoC★ 7
DevBuiHieu/CVE-2025-6558-Proof-Of-Concept
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote at
76RISK
open ↗GitHub PoC
nicecopy/POC-CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC★ 2
Fineken/Jenkins-CVE-2024-23897-Lab
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗GitHub PoC★ 11
CVE-2025-6018 Poc and Exploit
Pam-config: lpe from unprivileged to allow_active in pam
41RISK
open ↗GitHub PoC
bharath-cyber-root/sharepoint-toolshell-cve-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
rob0tstxt/POC-CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC★ 1
PoC exploit and vulnerable server demo for CVE-2025-1302 in jsonpath-plus.
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input
68RISK
open ↗GitHub PoC★ 2
Do you really think SharePoint is safe?
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
WordPress联系表单插件 - 未授权任意文件上传漏洞
Website Contact Form With File Upload <= 1.3.4 - Arbitrary File Upload
63RISK
open ↗GitHub PoC★ 1
Nuclei template to detect CVE-2024-6387. All latest patched versions are excluded.
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗GitHub PoC★ 8
Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
100RISK
open ↗GitHub PoC★ 8
Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
open ↗GitHub PoC
shan0ar/cve-2025-32756
A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCa
90RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.