Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC

Working Dirty Pipe (CVE-2022-0847) exploit tool with root access and file overwrites.

CVE-2022-0847HIGHunder attack25 Nov 2024

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

open ↗

GitHub PoC

Picsmize <= 1.0.0 - Unauthenticated Arbitrary File Upload

CVE-2024-52380CRITICAL25 Nov 2024

WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

48RISK

open ↗

GitHub PoC

Lis Video Gallery <= 0.2.1 - Unauthenticated PHP Object Injection

CVE-2024-52430CRITICAL25 Nov 2024

WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability

48RISK

open ↗

GitHub PoC

Magento 2 patch for CVE-2022-24086, CVE-2022-24087. Fix the RCE vulnerability and related bugs by performing deep template variable escaping. If you cannot upgrade Magento or cannot apply the official patches, try this one.

CVE-2022-24086CRITICALunder attack25 Nov 2024

Adobe Commerce checkout improper input validation leads to remote code execution

100RISK

open ↗

GitHub PoC

YassDEV221608/CVE-2024-6387

CVE-2024-6387HIGH24 Nov 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC

francescobrina/hfs-cve-2014-6287-exploit

CVE-2014-6287CRITICALunder attack24 Nov 2024

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

open ↗

GitHub PoC★ 1

Remote Command Execution into shell from a vulnerable exim service.

CVE-2019-10149CRITICALunder attack24 Nov 2024

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(

100RISK

open ↗

GitHub PoC

WolffCorentin/CVE-2019-1663-Binary-Analysis

CVE-2019-1663CRITICAL24 Nov 2024

Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability

85RISK

open ↗

GitHub PoC★ 1

Xss injection, WonderCMS 3.2.0 -3.4.2

CVE-2023-41425MEDIUM24 Nov 2024

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISK

open ↗

GitHub PoC★ 1

BohemianHacks/CVE-2024-21534-poc

CVE-2024-21534CRITICAL23 Nov 2024

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitizati

48RISK

open ↗

GitHub PoC

0-Gram/CVE-2022-41040

CVE-2022-41040HIGHunder attackransomware23 Nov 2024

Microsoft Exchange Server Elevation of Privilege Vulnerability

100RISK

open ↗

GitHub PoC★ 24

CVE-2024-35250 的 Beacon Object File (BOF) 实现。

CVE-2024-35250HIGHunder attack23 Nov 2024

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

91RISK

open ↗

GitHub PoC★ 1

CVE-2023-20198是思科IOS XE软件Web UI功能中的一个严重漏洞，允许未经身份验证的远程攻击者在受影响的系统上创建具有特权级别15的账户，从而完全控制设备。

CVE-2023-20198CRITICALunder attack23 Nov 2024

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS

100RISK

open ↗

GitHub PoC★ 1

CVE-2024-32002 是 Git 中的一个严重漏洞，允许攻击者在用户执行 git clone 操作时远程执行任意代码（RCE）。

CVE-2024-32002CRITICAL23 Nov 2024

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RISK

open ↗

GitHub PoC

Broken Authentication in Wordpress plugin (Wawp Plugin < 3.0.18)

CVE-2024-52475CRITICAL22 Nov 2024

WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability

48RISK

open ↗

GitHub PoC★ 2

CVE-2024-0012批量检测脚本

CVE-2024-0012CRITICALunder attackransomware22 Nov 2024

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

100RISK

open ↗

GitHub PoC

CVE-2024-0012是Palo Alto Networks PAN-OS软件中的一个身份验证绕过漏洞。该漏洞允许未经身份验证的攻击者通过网络访问管理Web界面，获取PAN-OS管理员权限，从而执行管理操作、篡改配置，或利用其他需要身份验证的特权提升漏洞（如CVE-2024-9474）

CVE-2024-0012CRITICALunder attackransomware22 Nov 2024

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

100RISK

open ↗

GitHub PoC

punitdarji/Paloalto-CVE-2024-0012

CVE-2024-0012CRITICALunder attackransomware22 Nov 2024

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

100RISK

open ↗

GitHub PoC

My Geo Posts Free <= 1.2 - Unauthenticated PHP Object Injection

CVE-2024-52433CRITICAL22 Nov 2024

WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

63RISK

open ↗

GitHub PoC★ 2

This tool scans WordPress websites for vulnerabilities in the WP Time Capsule plugin related to CVE-2024-8856. It identifies plugin versions below 1.22.22 as vulnerable and logs results to vuln.txt. Simple and efficient, it helps security researchers and admins detect and address risks quickly.

CVE-2024-8856CRITICAL21 Nov 2024

Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

85RISK

open ↗

GitHub PoC★ 1

This is POC of CVE-2024-29671

CVE-2024-29671CRITICAL21 Nov 2024

Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code vi

53RISK

open ↗

GitHub PoC★ 1

This tool scans WordPress sites for vulnerabilities in the "RegistrationMagic" plugin (CVE-2024-10508). It checks for the presence of a specific version (`6.0.2.6`) and marks the site as vulnerable if found. The results are saved in a file (`vuln.txt`) for further analysis.

CVE-2024-10508CRITICAL21 Nov 2024

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

48RISK

open ↗

GitHub PoC

PoC for PAN-OS Exploit

CVE-2024-9474MEDIUMunder attackransomware20 Nov 2024

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

100RISK

open ↗

GitHub PoC

FAFAF

CVE-2018-15473MEDIUM20 Nov 2024

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati

70RISK

open ↗

GitHub PoC

POC for CVE-2024-10924 written in Python

CVE-2024-10924CRITICAL20 Nov 2024

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISK

open ↗

GitHub PoC★ 1

PANW NGFW CVE-2024-0012

CVE-2024-0012CRITICALunder attackransomware20 Nov 2024

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

100RISK

open ↗

GitHub PoC

GEO my WordPress < 4.5.0.2 - Unauthenticated LFI to RCE/PHAR Deserialization

CVE-2024-6330CRITICAL20 Nov 2024

GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI

48RISK

open ↗

GitHub PoC

CVE-2023-28354

CVE-2023-28354CRITICAL20 Nov 2024

An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against aff

48RISK

open ↗

GitHub PoC

CVE-2024-52316 - Apache Tomcat Authentication Bypass Vulnerability

CVE-2024-52316CRITICAL20 Nov 2024

Apache Tomcat: Authentication bypass when using Jakarta Authentication API

48RISK

open ↗

GitHub PoC★ 3

Vulnerable docker container for Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass CVE-2023-50164

CVE-2024-10924CRITICAL20 Nov 2024

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.