Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,899cataloged exploits

40,392CVEs with public exploitation

24,696lab-tested

All Referência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,556Metasploit 3,537✓ verified onlyrecent popular risk

18,020 exploits

GitHub PoC

This is a proof-of-concept exploit for CVE-2015-1578, a buffer overflow vulnerability in Achat 0.150 beta7 on Windows. Exploitation leads to remote code execution via a crafted UDP packet.

CVE-2015-1578—19 Jun 2025

Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web s

23RISK

GitHub PoC★ 2

CVE-2025-3248 — Langflow RCE Exploit

CVE-2025-3248CRITICALunder attackransomware19 Jun 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISK

GitHub PoC

DevinLiggins14/SMB-PenTest-Exploiting-CVE-2007-2447-on-Metasploitable-2

CVE-2007-2447—19 Jun 2025

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISK

GitHub PoC

Unauthenticated RCE via Webmin Backdoor (CVE-2019–15107)

CVE-2019-15107CRITICALunder attackransomware19 Jun 2025

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

GitHub PoC

CVE-2019–11043: PHP-FPM Nginx Remote Code Execution Vulnerability

CVE-2019-11043HIGHunder attackransomware19 Jun 2025

Underflow in PHP-FPM can lead to RCE

100RISK

GitHub PoC★ 1

CVE-2025-33053 Checker and PoC

CVE-2025-33053HIGHunder attack18 Jun 2025

Internet Shortcut Files Remote Code Execution Vulnerability

100RISK

GitHub PoC★ 2

imbas007/CVE-2025-3248

CVE-2025-3248CRITICALunder attackransomware18 Jun 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISK

GitHub PoC

Exploit for Langflow AI Remote Code Execution (Unauthenticated)

CVE-2025-3248CRITICALunder attackransomware18 Jun 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISK

GitHub PoC★ 3

Proof-of-Concept for CVE-2025-33053 Exploiting WebDAV with .url file delivery to demonstrate realistic remote code execution. Includes a decoy PDF payload and a video-only showcase of potential command-and-control capabilities.

CVE-2025-33053HIGHunder attack18 Jun 2025

Internet Shortcut Files Remote Code Execution Vulnerability

100RISK

GitHub PoC

punitdarji/roundcube-cve-2025-49113

CVE-2025-49113CRITICALunder attack18 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

GitHub PoC

Kernel Pool Overflow Exploit targeting CVE-2021-31956

CVE-2021-31956HIGHunder attack17 Jun 2025

Windows NTFS Elevation of Privilege Vulnerability

76RISK

GitHub PoC★ 18

CVE-2025-3248 Langflow RCE Exploit

CVE-2025-3248CRITICALunder attackransomware17 Jun 2025

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

100RISK

GitHub PoC

Explicação + Lab no THM

CVE-2025-49113CRITICALunder attack17 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

GitHub PoC

EdouardosStav/CVE-2019-15107-RCE-WebMin

CVE-2019-15107CRITICALunder attackransomware17 Jun 2025

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

GitHub PoC

PoC Exploit for the NTLM reflection SMB flaw.

CVE-2025-33073HIGHunder attack17 Jun 2025

Windows SMB Client Elevation of Privilege Vulnerability

93RISK

GitHub PoC

A hands-on vulnerability assessment and exploitation of a Windows 7 VM using the EternalBlue (CVE-2017-0143) exploit. Includes scanning, exploitation with Metasploit, post-exploitation, and remediation steps in a controlled lab environment.

CVE-2017-0143HIGHunder attackransomware17 Jun 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

GitHub PoC

A Python-based Exploit Script for CVE-2016-3088

CVE-2016-3088CRITICALunder attack16 Jun 2025

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitr

100RISK

GitHub PoC★ 4

SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal

CVE-2024-28995HIGHunder attack15 Jun 2025

SolarWinds Serv-U L Directory Transversal Vulnerability

100RISK

GitHub PoC★ 2

CrushFTP 11.3.1 - Authentication Bypass

CVE-2025-31161CRITICALunder attackransomware15 Jun 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISK

GitHub PoC★ 3

CVE-2023-1698 exploit with golang

CVE-2023-1698CRITICAL15 Jun 2025

WAGO: WBM Command Injection in multiple products

85RISK

GitHub PoC★ 3

CVE-2024-4577.py

CVE-2024-4577CRITICALunder attackransomware15 Jun 2025

Argument Injection in PHP-CGI

100RISK

GitHub PoC

Exerrdev/CVE-2024-9264-Fixed

CVE-2024-9264CRITICAL15 Jun 2025

Grafana SQL Expressions allow for remote code execution

85RISK

GitHub PoC★ 2

Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass

CVE-2024-0204CRITICAL15 Jun 2025

Authentication Bypass in GoAnywhere MFT

85RISK

GitHub PoC★ 8

This project is a research-oriented and educational simulation designed to demonstrate the concept of a sandbox escape vulnerability within Google Chrome (version 134.0.6998.177), leveraging improper handle , validation via Mojo IPC.

CVE-2025-2783HIGHunder attack15 Jun 2025

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow

71RISK

GitHub PoC★ 1

This Python script checks for the presence of CVE-2024-40898, a critical vulnerability in Apache HTTP Server that may allow SSL/TLS certificate verification bypass under certain misconfigurations. It initiates an SSL connection to the target server and sends a HEAD request.

CVE-2024-40898CRITICAL14 Jun 2025

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

48RISK

GitHub PoC★ 2

Checks if your Chrome version is vulnerable to CVE-2025-5419, from the browser

CVE-2025-5419HIGHunder attack14 Jun 2025

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially expl

71RISK

GitHub PoC★ 1

grass341/CVE-2022-37969

CVE-2022-37969HIGHunder attackransomware14 Jun 2025

Windows Common Log File System Driver Elevation of Privilege Vulnerability

76RISK

GitHub PoC★ 1

LipeOzyy/CVE-2010-1872-BlazeDVD-SEH-Exploit

CVE-2010-1872—14 Jun 2025

Cross-site scripting (XSS) vulnerability in cPlayer.php in FlashCard 2.6.5 and 3.0.1 allows remote attackers to inject a

23RISK

GitHub PoC

maqeel-git/CVE-2020-0796

CVE-2020-0796CRITICALunder attackransomware14 Jun 2025

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

GitHub PoC

MAHABUB122003/Atlassian-CVE-2022-26134

CVE-2022-26134CRITICALunder attackransomware14 Jun 2025

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.