Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,496cataloged exploits
34,964CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,899GitHub PoC 13,937VulnCheck XDB 8,510Nuclei 4,239Metasploit 3,468✓ verified onlyrecentpopularrisk
13,937 exploits
GitHub PoC★ 38
Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC★ 10
Spring cloud gateway code injection : CVE-2022-22947
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC
poc for cve-2022-22947
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC
takumak/cve-2019-5736-reproducer
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
open ↗GitHub PoC★ 4
A "Creation of Temporary Files in Directory with Insecure Permissions" vulnerability in PrintixService.exe, in Printix's "Printix Secure Cloud Print Management", Version 1.3.1106.0 and below allows any logged in user to elevate any executable or file to the SYSTEM context. This is achieved by exploiting race conditions in the Installer.
Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure
28RISK
open ↗GitHub PoC★ 223
CVE-2022-22947
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC
Tools for get offsets and adding patch for support i386
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
43RISK
open ↗GitHub PoC★ 15
Zabbix - SAML SSO Authentication Bypass
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗GitHub PoC★ 47
Test whether a container environment is vulnerable to container escapes via CVE-2022-0492
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Th
86RISK
open ↗GitHub PoC
This script is intended to validate Apache Struts 2 vulnerability (CVE-2017-5638), AKA Struts-Shock.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗GitHub PoC
CVE-2022-24086 RCE
Adobe Commerce checkout improper input validation leads to remote code execution
100RISK
open ↗GitHub PoC★ 1
Android Ransomware Development - AES256 encryption + CVE-2019-2215 (reverse root shell) + Data Exfiltration
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
98RISK
open ↗GitHub PoC
skentagon/CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC★ 1
Fa1c0n35/zabbix-cve-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗GitHub PoC★ 303
PoC for CVE-2022-21971 "Windows Runtime Remote Code Execution Vulnerability"
Windows Runtime Remote Code Execution Vulnerability
83RISK
open ↗GitHub PoC★ 8
Apache APISIX batch-requests RCE(CVE-2022-24112)
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISK
open ↗GitHub PoC★ 8
POC for CVE-2022-24124
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as d
50RISK
open ↗GitHub PoC★ 1
Script to demonstrate the Grafana directory traversal exploit (CVE-2021-43798).
Grafana path traversal
100RISK
open ↗GitHub PoC★ 1
trganda/CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗GitHub PoC★ 2
pykiller/CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗GitHub PoC★ 8
Zabbix SSO Bypass
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗GitHub PoC★ 43
CVE-2022-24112：Apache APISIX apisix/batch-requests RCE
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISK
open ↗GitHub PoC
Apache APISIX apisix/batch-requests RCE
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
100RISK
open ↗GitHub PoC★ 29
cve-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗GitHub PoC★ 2
mxypoo/CVE-2016-3116-DropbearSSH
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-c
28RISK
open ↗GitHub PoC
TheJoyOfHacking/SecuraBV-CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC★ 1
TheJoyOfHacking/dirkjanm-CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC
CVE-2019-15107 Webmin 1.920 RCE
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗GitHub PoC★ 1
poc
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.