Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
88,871 exploits
GitHub PoC
Laboratorio de análisis y explotación de la vulnerabilidad CVE-2025-5548 en FreeFloat FTP Server 1.0
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗GitHub PoC
sumaiyafathima-code/CVE-2023-27524
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISK
open ↗GitHub PoC
POC for log4shll Vulnerablity (CVE-2021-44228)
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Script and node.proto for exploit CVE-2025-68926
RustFS has a gRPC Hardcoded Token Authentication Bypass
60RISK
open ↗GitHub PoC
CVE-2018-6606
An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows
23RISK
open ↗GitHub PoC
Heap Buffer Overflow in CVE-2025-5548
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗GitHub PoC
Análisis técnico, preparación de entorno de laboratorio y desarrollo de exploit (RCE) para la vulnerabilidad CVE-2025-5548 en FreeFloat FTP Server.
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗GitHub PoC
LorenzoPorrasDuque/CVE-2025-5548-POC
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗GitHub PoC
MotionEye v0.43.1b4 OS Command Injection
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name
61RISK
open ↗GitHub PoC
Explotación de la vulnerabilidad CVE-2025-5548, paso a paso
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗VulnCheck XDB
initial-access
Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
68RISK
open ↗VulnCheck XDB
client-side
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.
76RISK
open ↗VulnCheck XDB
initial-access
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that
100RISK
open ↗VulnCheck XDB
initial-access
cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
60RISK
open ↗GitHub PoC★ 8
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (CVE-2026-3891) PoC
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
75RISK
open ↗GitHub PoC
Python PoC for CVE-2025-60787, authenticated OS command injection RCE in motionEye <= 0.43.1b4 via unsanitized image_file_name config
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name
61RISK
open ↗GitHub PoC
0xTerror/CVE-2025-6934
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
68RISK
open ↗GitHub PoC
Research of CVE-2024-3094 vulnerability.
Xz: malicious code in distributed source
70RISK
open ↗GitHub PoC★ 1
Proof‑of‑concept Python script demonstrating CVE‑2023‑43208 in Mirth Connect, allowing version checks and command execution on vulnerable instances.
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that
100RISK
open ↗GitHub PoC★ 10
Adaptation of Cassowary CVE-2024-23222 for Linux x86_64
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.
76RISK
open ↗GitHub PoC
Entorno y explotación de la vulnerabilidad CVE-2025-5548
FreeFloat FTP Server NOOP Command buffer overflow
38RISK
open ↗GitHub PoC
CVE-2017-0199 XLS --> HTA --> VBS --> STEGANOGRAPHY --> DBATLOADER/GULOADER STYLE MALWARE
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗GitHub PoC
Basic Proof of Concept (Poc) Exploit for React RSC - CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗Metasploit600
WordPress Unauthenticated RCE via Pix for WooCommerce plugin
Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload
75RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.