Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,904cataloged exploits

40,394CVEs with public exploitation

24,696lab-tested

All Referência 26,190Exploit-DB 24,488GitHub PoC 18,020VulnCheck XDB 10,108Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,020 exploits

GitHub PoC

CVE-2021-3156-Exploit-Demo

CVE-2021-3156HIGHunder attack09 Jun 2025

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC★ 3

Security Vulnerability Report: CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability

CVE-2025-24071MEDIUM09 Jun 2025

Microsoft Windows File Explorer Spoofing Vulnerability

38RISK

open ↗

GitHub PoC★ 1

CVE-2024-10914 is a critical command injection vulnerability affecting several legacy D-Link Network Attached Storage (NAS) devices.

CVE-2024-10914CRITICAL09 Jun 2025

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISK

open ↗

GitHub PoC

CVE-2025-0282

CVE-2025-0282CRITICALunder attackransomware08 Jun 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISK

open ↗

GitHub PoC

binneko/CVE-2025-46041

CVE-2025-46041MEDIUM08 Jun 2025

A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript

33RISK

open ↗

GitHub PoC★ 1

Songul-Kizilay/CVE-2014-0346

CVE-2014-0346—08 Jun 2025

20RISK

open ↗

GitHub PoC

CyberBibs/Event-ID-263-Arbitrary-File-Read-on-Checkpoint-Security-Gateway-CVE-2024-24919-

CVE-2024-24919HIGHunder attackransomware08 Jun 2025

Information disclosure

100RISK

open ↗

GitHub PoC

CyberBibs/SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400-

CVE-2024-3400CRITICALunder attackransomware08 Jun 2025

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

100RISK

open ↗

GitHub PoC

CVE-2024-40453 - Squirrelly v9.0.0 RCE. Poc

CVE-2024-40453CRITICAL08 Jun 2025

squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the com

48RISK

open ↗

GitHub PoC★ 1

CVE-2017-5638 Exploit Rewritten In Python By haxerr9

CVE-2017-5638CRITICALunder attackransomware07 Jun 2025

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISK

open ↗

GitHub PoC

CVE-2025-31161

CVE-2025-31161CRITICALunder attackransomware07 Jun 2025

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle

100RISK

open ↗

GitHub PoC

CVE-2025-31131

CVE-2025-31131HIGH07 Jun 2025

Path Traversal allowing arbitrary read of files in Yeswiki

56RISK

open ↗

GitHub PoC

CVE-2024-51482 ZoneMinder v1.37.* <= 1.37.64 poc

CVE-2024-51482CRITICAL07 Jun 2025

Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

75RISK

open ↗

GitHub PoC★ 21

mbanyamer/CVE-2025-24076

CVE-2025-24076HIGH06 Jun 2025

Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability

41RISK

open ↗

GitHub PoC★ 94

Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113).

CVE-2025-49113CRITICALunder attack06 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

open ↗

GitHub PoC

POC

CVE-2025-30208MEDIUM06 Jun 2025

Vite bypasses server.fs.deny when using `?raw??`

70RISK

open ↗

GitHub PoC

This is a little Python script to detect the "EvilSun" vulnerability (CVE-2020-14871) on Solaris systems. The vulnerability is a buffer overflow in the Pluggable Authentication Module (PAM) `pam_unix_auth` when handling keyboard-interactive authentication in SSH.

CVE-2020-14871CRITICALunder attack06 Jun 2025

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve

100RISK

open ↗

GitHub PoC

🚨 Exploit CVE-2025-55182 to demonstrate RCE in React Server Functions, highlighting risks from insecure prototype references in Next.js applications.

CVE-2025-55182CRITICALunder attackransomware06 Jun 2025

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 2

CVE-2025-49113 exploit

CVE-2025-49113CRITICALunder attack06 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

open ↗

GitHub PoC

PoC for CVE-2024-42049

CVE-2024-42049CRITICAL05 Jun 2025

TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.

48RISK

open ↗

GitHub PoC★ 1

CyberQuestor-infosec/CVE-2022-46604-Responsive-File-Manager

CVE-2022-46604HIGH05 Jun 2025

An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanis

41RISK

open ↗

GitHub PoC★ 3

rasool13x/exploit-CVE-2025-49113

CVE-2025-49113CRITICALunder attack05 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

open ↗

GitHub PoC★ 1

Repositorio de investigación de seguridad que contiene una Prueba de Concepto (PoC) para la vulnerabilidad CVE-2021-4034 (PwnKit) y utilidades de scripting para la demostración de escalada de privilegios y ejecución remota en entornos Linux.

CVE-2021-4034HIGHunder attackransomware05 Jun 2025

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

open ↗

GitHub PoC★ 198

Proof of Concept for CVE-2025-32756 - A critical stack-based buffer overflow vulnerability affecting multiple Fortinet products.

CVE-2025-32756CRITICALunder attack05 Jun 2025

A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCa

90RISK

open ↗

GitHub PoC

MantisToboggan-git/CVE-2025-4632-POC

CVE-2025-4632CRITICALunder attack04 Jun 2025

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 2

98RISK

open ↗

GitHub PoC

Superliverbun/cve-2021-3156-

CVE-2021-3156HIGHunder attack04 Jun 2025

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC★ 109

fearsoff-org/CVE-2025-49113

CVE-2025-49113CRITICALunder attack04 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

open ↗

GitHub PoC

gmh5225/cve-2021-3156-

CVE-2021-3156HIGHunder attack04 Jun 2025

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC★ 3

CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserialization

CVE-2025-49113CRITICALunder attack04 Jun 2025

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the

100RISK

open ↗

GitHub PoC

Authenticated Remote Command Execution - Webmin <= 1.910

CVE-2019-12840—04 Jun 2025

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root pr

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.