Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
18,044 exploits
GitHub PoC★ 12
CVE-2024-49112 LDAP RCE PoC and Metasploit Module
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
The **Dirty Pipe exploit (CVE-2022-0847)** is a Linux kernel vulnerability (v5.8+) allowing unprivileged attackers to overwrite arbitrary files via a flaw in the pipe mechanism. This leads to privilege escalation, granting root access. Similar to Dirty Cow but easier to exploit. Fix: Update to a patched kernel version.
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC★ 1
punitdarji/Apache-struts-cve-2024-53677
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RISK
open ↗GitHub PoC
Taldrid1/cve-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC
JustinYe377/CTF-CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC★ 121
GeoServer（CVE-2024-36401/CVE-2024-36404）漏洞利用工具
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISK
open ↗GitHub PoC★ 3
An rewritten POC on the CVE-2014-3704
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct
60RISK
open ↗GitHub PoC★ 3
CVE-2024-4367 is a critical vulnerability (CVSS 9.8) in PDF.js, allowing arbitrary JavaScript code execution due to insufficient type checks on the FontMatrix object within PDF files.
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC★ 1
POC exploit for CVE-2024-25641
Cacti RCE vulnerability when importing packages
85RISK
open ↗GitHub PoC★ 6
CRUNZEX/CVE-2025-22968
An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account witho
48RISK
open ↗GitHub PoC
Cacti v1.2.22: Unauthenticated Command Injection Vulnerability (CVE-2022-46169)
Unauthenticated Command Injection
100RISK
open ↗GitHub PoC
Powershell Script to build token for CVE-2019-1619
Cisco Data Center Network Manager Authentication Bypass Vulnerability
85RISK
open ↗GitHub PoC★ 17
YassDEV221608/CVE-2024-6387_PoC
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗GitHub PoC
Nxploited/CVE-2023-51409
WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
75RISK
open ↗GitHub PoC
MASS CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC
Exploiting CVE-2023-2825 on a VM
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RISK
open ↗GitHub PoC★ 5
Cleo 远程代码执行漏洞批量检测脚本（CVE-2024-50623）
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗GitHub PoC
luongchivi/Preproduce-CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC★ 3
CVE-2023-38831 (PoC) - WinRAR Exploit
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
open ↗GitHub PoC★ 12
math-x-io/CVE-2024-54152-poc
Angular Expressions - Remote Code Execution when using locals
48RISK
open ↗GitHub PoC★ 6
AutoBlue - Automated EternalBlue (CVE-2017-0144 / MS17-010) exploitation tool leveraging Nmap and Metasploit for ethical hacking, penetration testing, and CTF challenges. Strictly for authorized and educational use only!
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗GitHub PoC★ 1
CVE-2024-54819
I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input valid
53RISK
open ↗GitHub PoC★ 2
PoC for CVE-2024-21182
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RISK
open ↗GitHub PoC★ 1
PoC for CVE-2024-21182
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
93RISK
open ↗GitHub PoC★ 2
Hi this is a revised and enhanced code for CVE-2019-0232
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISK
open ↗GitHub PoC★ 1
Nxploited/CVE-2024-9234
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
68RISK
open ↗GitHub PoC
Citrix Virtual Apps and Desktops (XEN) Unauthenticated RCE
Limited remote code execution with privilege of a NetworkService Account access
68RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.