Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,899cataloged exploits
40,392CVEs with public exploitation
24,696lab-tested
AllReferência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecentpopularrisk
18,020 exploits
GitHub PoC★ 1
CVE‑2025‑30208 is a medium-severity arbitrary file read vulnerability in the Vite development server (a popular frontend build tool)
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC★ 13
A simple proof of concept for WinRAR Path Traversal | RCE | CVE-2025-6218
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
93RISK
open ↗GitHub PoC
Exploit Code for CVE-2024-39930 gogs ssh server RCE
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code
48RISK
open ↗GitHub PoC★ 1
POC for PDF JS' CVE-2024-4367 vuln
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
obscura-cert/CVE-2025-31650
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
53RISK
open ↗GitHub PoC
aninfosec/CVE-2024-43425-Poc
Moodle: remote code execution via calculated question types
78RISK
open ↗GitHub PoC★ 2
POC for PDF JS' CVE-2024-4367 vuln
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC★ 1
obscura-cert/CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
93RISK
open ↗GitHub PoC★ 21
Unauthenticated Python PoC for CVE-2025-20281 RCE against ISE ERS API
Cisco ISE API Unauthenticated Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
Escala de privilegios con CVE-2010-5195
Untrusted search path vulnerability in Roxio MyDVD 9 allows local users to gain privileges via a Trojan horse HomeUtils9
23RISK
open ↗GitHub PoC★ 1
Security analysis project: Real-world CVE breakdown
Xz: malicious code in distributed source
70RISK
open ↗GitHub PoC★ 3
Proof-of-concept and analysis for CVE-2025-32711
M365 Copilot Information Disclosure Vulnerability
48RISK
open ↗GitHub PoC★ 10
CVE‑2025‑30208 is a medium-severity arbitrary file read vulnerability in the Vite development server (a popular frontend build tool)
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC★ 17
speinador/CVE-2025-6218_WinRAR
RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability
93RISK
open ↗GitHub PoC
The objective of this project was to assess a remote host for the Heartbleed vulnerability (CVE-2014-0160), verify its presence, and exploit it to extract potentially sensitive information from server memory over the TLS protocol.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
open ↗GitHub PoC★ 7
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
63RISK
open ↗GitHub PoC★ 5
Script para determinar si Citrix es vulnerable al CVE-2025-6543
Memory overflow vulnerability leading to unintended control flow and Denial of Service
83RISK
open ↗GitHub PoC★ 4
Remote Code execution in CentOS web panel
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell
100RISK
open ↗GitHub PoC
Batch RCE scanner for vulnerable vBulletin instances using replaceAdTemplate exploit.
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t
75RISK
open ↗GitHub PoC
Poc - CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
open ↗GitHub PoC
luckyman2907/SMB-Protocol-Vulnerability_CVE-2017-0144
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗GitHub PoC
TI WooCommerce Wishlist (WordPress plugin) <= 2.9.2 CVE-2025-47577 PoC
WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability
63RISK
open ↗GitHub PoC
TI WooCommerce Wishlist (WordPress plugin) <= 2.8.2 CVE-2024-43917 PoC
WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability
68RISK
open ↗GitHub PoC★ 3
ademto/wordpress-cve-2024-10924-pentest
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RISK
open ↗GitHub PoC
hdgokani/CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property
100RISK
open ↗GitHub PoC
C-based PoC for CVE-2019-5736
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗GitHub PoC
Exploit para escalada de privilegios en Linux basado en la vulnerabilidad Dirty Cow (CVE-2016-5195). Incluye binario, código fuente e instrucciones para su uso en entornos controlados.
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗GitHub PoC
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.