Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

81,003cataloged exploits
37,620CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,482Referência 24,011GitHub PoC 15,501VulnCheck XDB 9,077Nuclei 4,427Metasploit 3,505✓ verified onlyrecentpopularrisk
81,003 exploits
GitHub PoC★ 14
A detailed walkthrough of TryHackMe's Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig
CVE-2023-30258CRITICAL13 Jul 2025
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISK
open ↗
GitHub PoC★ 14
A detailed walkthrough of Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig
CVE-2023-30258CRITICAL13 Jul 2025
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISK
open ↗
GitHub PoC
JayVillain/Scan-CVE-2025-6058
CVE-2025-6058CRITICAL13 Jul 2025
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
GitHub PoC
r0otk3r/CVE-2022-1388
CVE-2022-1388CRITICALunder attackransomware12 Jul 2025
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
GitHub PoC
r0otk3r/CVE-2024-1212
CVE-2024-1212CRITICALunder attack12 Jul 2025
LoadMaster Pre-Authenticated OS Command Injection
100RISK
open ↗
GitHub PoC★ 1
imbas007/CVE-2025-25257
CVE-2025-25257CRITICALunder attack12 Jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
GitHub PoC
Tool for detecting and exploiting CVE-2025-25257 in Fortinet FortiWeb.
CVE-2025-25257CRITICALunder attack12 Jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
GitHub PoC
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
CVE-2025-6058CRITICAL12 Jul 2025
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RISK
open ↗
VulnCheck XDB
initial-access
CVE-2025-25257CRITICALunder attack12 Jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-1388CRITICALunder attackransomware12 Jul 2025
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
GitHub PoC★ 1
Proof of Concept for CVE-2025-24813, a Remote Code Execution vulnerability in Apache Tomcat. This PoC exploits unsafe deserialization via crafted session files uploaded through HTTP PUT requests, allowing attackers to execute arbitrary code remotely on vulnerable Tomcat servers.
CVE-2025-24813CRITICALunder attack12 Jul 2025
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗
GitHub PoC★ 1
Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.
CVE-2025-25257CRITICALunder attack12 Jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
GitHub PoC
pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck-
CVE-2013-3900MEDIUMunder attack12 Jul 2025
WinVerifyTrust Signature Validation Vulnerability
75RISK
open ↗
VulnCheck XDB
initial-access
CVE-2025-25257CRITICALunder attack12 Jul 2025
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗
GitHub PoC★ 1
Python exploit for vsftpd 2.3.4 - Backdoor Command Execution
CVE-2011-2523—12 Jul 2025
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2024-24919HIGHunder attackransomware12 Jul 2025
Information disclosure
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-1212CRITICALunder attack12 Jul 2025
LoadMaster Pre-Authenticated OS Command Injection
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2025-24813CRITICALunder attack12 Jul 2025
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗
GitHub PoC
MacUchegit/Detecting-and-Analyzing-CVE-2024-24919-Exploitation
CVE-2024-24919HIGHunder attackransomware12 Jul 2025
Information disclosure
100RISK
open ↗
GitHub PoC
This repository contains Detailed explanation and working poc for Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution.
CVE-2014-6287CRITICALunder attack11 Jul 2025
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
VulnCheck XDB
client-side
CVE-2024-4577CRITICALunder attackransomware11 Jul 2025
Argument Injection in PHP-CGI
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2014-6287CRITICALunder attack11 Jul 2025
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗
VulnCheck XDB
local
CVE-2025-32463CRITICALunder attack11 Jul 2025
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-10915CRITICAL11 Jul 2025
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISK
open ↗
VulnCheck XDB
client-side
CVE-2024-4577CRITICALunder attackransomware11 Jul 2025
Argument Injection in PHP-CGI
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-32113CRITICALunder attack11 Jul 2025
Apache OFBiz: Path traversal leading to RCE
100RISK
open ↗
GitHub PoC
Delivering PHP RCE (CVE-2024-4577) to the Local Network Servers
CVE-2024-4577CRITICALunder attackransomware11 Jul 2025
Argument Injection in PHP-CGI
100RISK
open ↗
GitHub PoC
r0otk3r/CVE-2024-10915
CVE-2024-10915CRITICAL11 Jul 2025
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISK
open ↗
GitHub PoC
Metasploit module for MailEnable CVE-2022-36934 authentication bypass RCE
CVE-2022-36934CRITICAL11 Jul 2025
An integer overflow in WhatsApp could result in remote code execution in an established video call.
48RISK
open ↗
GitHub PoC
just remeber how small mistake in santisize username could give yoy root access to the full machine
CVE-2007-2447—11 Jul 2025
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗
← previouspage 303 / 2,701next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.