Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
81,003cataloged exploits
37,620CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 24,011GitHub PoC 15,501VulnCheck XDB 9,077Nuclei 4,427Metasploit 3,505✓ verified onlyrecentpopularrisk
81,003 exploits
VulnCheck XDB
initial-access
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 6
PoC exploits CVE-2025-24893 , a remote code execution (RCE) vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered asynchronously. It allows arbitrary command execution through injection into RSS-based SolrSearch endpoints.
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗VulnCheck XDB
initial-access
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC
CVE-2024-2771 Proof-of-Concept
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation
63RISK
open ↗Exploit-DB
Swagger UI 1.0.3 - Cross-Site Scripting (XSS)
macrozheng mall Swagger UI index.html cross site scripting
33RISK
open ↗GitHub PoC★ 5
Modified exploit for CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC★ 2
Exploit SQL injection in projectworlds Online Admissions System v1.0
projectworlds Online Admission System adminlogin.php sql injection
33RISK
open ↗VulnCheck XDB
client-side
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation
56RISK
open ↗Exploit-DB
Gandia Integra Total 4.4.2236.1 - SQL Injection
SQL injection vulnerability in Gandia Integra Total
41RISK
open ↗GitHub PoC
Reverse Shell Payload for CVE-2025-24893
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗GitHub PoC
beishanxueyuan/CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗GitHub PoC
fluoworite/CVE-2025-48384-sub
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗GitHub PoC
PoC for CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗Exploit-DB
Microsoft Virtual Hard Disk (VHDX) 11 - Remote Code Execution (RCE)
Microsoft Virtual Hard Disk Remote Code Execution Vulnerability
41RISK
open ↗GitHub PoC
dhiaZnaidi/CVE-2025-24893-PoC
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗Exploit-DB
Copyparty 1.18.6 - Reflected Cross-Site Scripting (XSS)
copyparty Reflected XSS via Filter Parameter
48RISK
open ↗Exploit-DB
LPAR2RRD 8.04 - Remote Code Execution (RCE)
KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
41RISK
open ↗GitHub PoC
A short and sweet simple exploit script for the CVE-2012-2982 Authenticated RCE vulnerability in the /file/show.cgi/bin endpoint.
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid
50RISK
open ↗Exploit-DB
Microsoft Edge (Chromium-based) 135.0.7049.114/.115 - Information Disclosure
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
41RISK
open ↗GitHub PoC
CVE-2025-46811
SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint
53RISK
open ↗GitHub PoC★ 3
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RISK
open ↗GitHub PoC★ 1
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RISK
open ↗GitHub PoC★ 1
A critical vulnerability in Microsoft SharePoint Server allows unauthenticated remote code execution via deserialization of untrusted data. Microsoft is aware of active exploitation; apply CVE mitigations immediately. Severity: Critical.
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
AdnanApriliyansyahh/CVE-2022-1592
Server-Side Request Forgery in scout in clinical-genomics/scout
48RISK
open ↗VulnCheck XDB
initial-access
Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
68RISK
open ↗GitHub PoC
Demo web server
BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload
63RISK
open ↗VulnCheck XDB
initial-access
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
48RISK
open ↗VulnCheck XDB
initial-access
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RISK
open ↗VulnCheck XDB
initial-access
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
75RISK
open ↗VulnCheck XDB
initial-access
Remote code execution as guest via SolrSearchMacros request in xwiki
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.