Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,107cataloged exploits

34,679CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecent popular risk

13,812 exploits

GitHub PoC★ 1

Unrestricted File Upload by Weak Encryption affected versions (CVE-2017-11317) 2. Remote Code Execution by Insecure Deserialization - (CVE-2019-18935)

CVE-2017-11317CRITICALunder attack13 Oct 2022

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload

100RISK

GitHub PoC

Arbitrary code execution analysis based on Telerik-UI. This will be done so that the article can be read by others. The document provides an in-depth explanation of the various vectors involved with Telerik-UI for ASP.NET AJAX, as well as POST requests, the architecture of ASP.NET AJAX,

CVE-2017-11317CRITICALunder attack13 Oct 2022

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload

100RISK

GitHub PoC★ 1

Unrestricted File Upload by Weak Encryption affected versions (CVE-2017-11317) 2. Remote Code Execution by Insecure Deserialization - (CVE-2019-18935)

CVE-2019-18935CRITICALunder attackransomware13 Oct 2022

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

100RISK

GitHub PoC★ 3

r00t4dm/Jenkins-CVE-2017-1000353

CVE-2017-1000353CRITICALunder attack12 Oct 2022

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code exe

100RISK

GitHub PoC★ 1

MariliaMeira/CVE-2019-14287

CVE-2019-14287—12 Oct 2022

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se

35RISK

GitHub PoC★ 1

6E6L6F/CVE-2022-35914

CVE-2022-35914CRITICALunder attack12 Oct 2022

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISK

GitHub PoC

r00t4dm/Jenkins-CVE-2015-8103

CVE-2015-8103—12 Oct 2022

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary co

60RISK

GitHub PoC

Remote shell on CVE-2009-4623

CVE-2009-4623—12 Oct 2022

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbi

23RISK

GitHub PoC★ 9

RCE Exploit and Research

CVE-2022-40471CRITICAL12 Oct 2022

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via p

68RISK

GitHub PoC

edsonjt81/CVE-2022-0847-DirtyPipe-

CVE-2022-0847HIGHunder attack12 Oct 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

GitHub PoC

r00t4dm/Jenkins-CVE-2016-9299

CVE-2016-9299—12 Oct 2022

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a

60RISK

GitHub PoC★ 2

0x1nsomnia/CVE-2022-36067-vm2-POC-webapp

CVE-2022-36067CRITICAL12 Oct 2022

vm2 vulnerable to Sandbox Escape before v3.9.11

60RISK

GitHub PoC★ 6

CVE-2021-3129-Laravel Debug mode

CVE-2021-3129CRITICALunder attackransomware11 Oct 2022

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISK

GitHub PoC★ 1

Compled version of CVE-2022-0847 aka Dirty Pipe. Just one shot to root them all :D

CVE-2022-0847HIGHunder attack11 Oct 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

GitHub PoC★ 1

TP-Link Tapo c200 ver <1.1.15 - Remote Code Execution (RCE)

CVE-2021-4045CRITICAL11 Oct 2022

TP-LINK Tapo C200 remote code execution vulnerability

70RISK

GitHub PoC

testtesttesttesttesttesttesttesttesttest

CVE-2022-31479CRITICAL10 Oct 2022

Remote Code Execution via command injection of the hostname

48RISK

GitHub PoC★ 8

cve-2022-41352 poc

CVE-2022-41352CRITICALunder attack10 Oct 2022

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through ama

100RISK

GitHub PoC★ 2

polkit priv esc: pkexec out of boundary exploit

CVE-2021-4034HIGHunder attack10 Oct 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

GitHub PoC★ 3

Detecting CVE-2022-26134 using Nuclei

CVE-2022-26134CRITICALunder attackransomware09 Oct 2022

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

GitHub PoC★ 2

Lzer0Kx01/CVE-2022-35914

CVE-2022-35914CRITICALunder attack09 Oct 2022

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

100RISK

GitHub PoC★ 91

CVE-2022-41040 - Server Side Request Forgery (SSRF) in Microsoft Exchange Server

CVE-2022-41040HIGHunder attackransomware09 Oct 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability

100RISK

GitHub PoC★ 5

Script to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)

CVE-2022-41040HIGHunder attackransomware09 Oct 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability

100RISK

GitHub PoC★ 7

CVE-2022-39197 bug fix patch

CVE-2022-39197MEDIUMunder attack09 Oct 2022

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote att

75RISK

GitHub PoC★ 224

Authenticated Remote Command Execution in Gitlab via GitHub import

CVE-2022-2992CRITICAL08 Oct 2022

A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows

85RISK

GitHub PoC★ 10

7BitsTeam/exch_CVE-2021-42321

CVE-2021-42321HIGHunder attackransomware08 Oct 2022

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

GitHub PoC★ 5

Open Web Analytics (OWA) - Unauthenticated Remote Code Execution

CVE-2022-24637—08 Oct 2022

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, wh

60RISK

GitHub PoC

This is a exploit for CVE-2019-9053

CVE-2019-9053—08 Oct 2022

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISK

GitHub PoC★ 3

Grafana - Directory Traversal and Arbitrary File Read

CVE-2021-43798HIGHunder attack08 Oct 2022

Grafana path traversal

100RISK

GitHub PoC★ 14

POC Of CVE-2022-26937

CVE-2022-26937CRITICAL07 Oct 2022

Windows Network File System Remote Code Execution Vulnerability

70RISK

GitHub PoC★ 1

Exploit for CVE-2021-29156

CVE-2021-29156—07 Oct 2022

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacke

60RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.