Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC★ 1

CVE-2021-40539：ADSelfService Plus RCE漏洞

CVE-2021-40539CRITICALunder attackransomware12 Oct 2024

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

100RISK

open ↗

GitHub PoC

CVE-2021-40539：ADSelfService Plus RCE漏洞

CVE-2021-40539CRITICALunder attackransomware12 Oct 2024

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

100RISK

open ↗

GitHub PoC

intel365/CVE-2024-7593

CVE-2024-7593CRITICALunder attack12 Oct 2024

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo

100RISK

open ↗

GitHub PoC★ 2

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

CVE-2024-8529CRITICAL12 Oct 2024

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

68RISK

open ↗

GitHub PoC

Checkpoint SQL Injection via Time-Based Attack (CVE-2024-9465)

CVE-2024-9465CRITICALunder attack11 Oct 2024

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

100RISK

open ↗

GitHub PoC★ 1

test_private_CVE

CVE-2024-23113CRITICALunder attack11 Oct 2024

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.

90RISK

open ↗

GitHub PoC★ 1

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

CVE-2024-9707CRITICAL11 Oct 2024

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

63RISK

open ↗

GitHub PoC★ 1

OxLmahdi/cve-2024-5932

CVE-2024-5932CRITICAL11 Oct 2024

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

85RISK

open ↗

GitHub PoC★ 2

intel365/CVE-2024-29973

CVE-2024-29973CRITICAL10 Oct 2024

** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar

85RISK

open ↗

GitHub PoC★ 6

p33d/CVE-2024-9441

CVE-2024-9441CRITICAL10 Oct 2024

Linear eMerge e3-Series Forgot Password Command Injection

60RISK

open ↗

GitHub PoC★ 5

is a PoC tool designed to exploit insecurely exposed debug logs from WordPress sites and extract session cookies

CVE-2024-44000CRITICAL10 Oct 2024

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

85RISK

open ↗

GitHub PoC★ 3

is a PoC tool that targets a vulnerability in the TeamCity server (CVE-2024-27198)

CVE-2024-27198CRITICALunder attackransomware09 Oct 2024

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

100RISK

open ↗

GitHub PoC★ 2

intel365/CVE-2024-2876

CVE-2024-2876CRITICAL09 Oct 2024

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

85RISK

open ↗

GitHub PoC★ 44

Proof of Concept Exploit for CVE-2024-9464

CVE-2024-9464CRITICAL09 Oct 2024

Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

70RISK

open ↗

GitHub PoC★ 31

Proof of Concept Exploit for CVE-2024-9465

CVE-2024-9465CRITICALunder attack09 Oct 2024

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

100RISK

open ↗

GitHub PoC★ 1

intel365/CVE-2024-24919

CVE-2024-24919HIGHunder attackransomware09 Oct 2024

Information disclosure

100RISK

open ↗

GitHub PoC★ 17

CVE-2024-38077: Remote Code Execution Vulnerability in Windows Remote Desktop Licensing Service

CVE-2024-38077CRITICAL09 Oct 2024

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC★ 27

Unauthenticated Remote Code Execution via Angular-Base64-Upload Library

CVE-2024-42640CRITICAL09 Oct 2024

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo

75RISK

open ↗

GitHub PoC★ 1

Performs an IPv6 vulnerability scan and packet flood attack on specified targets. The script simulates a SYN flood and ICMP flood attack and optionally sends exploit packets.

CVE-2024-38063CRITICAL08 Oct 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC

Apache CouchDB 3.2.1 - Remote Code Execution (RCE) Checker

CVE-2022-24706CRITICALunder attack08 Oct 2024

Remote Code Execution Vulnerability in Packaging

100RISK

open ↗

GitHub PoC★ 1

Agilevatester/FlaskCache_CVE-2021-33026_POC

CVE-2021-33026CRITICAL08 Oct 2024

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code e

48RISK

open ↗

GitHub PoC

TeamCity server scanner to detect CVE-2023-42793

CVE-2023-42793CRITICALunder attackransomware08 Oct 2024

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RISK

open ↗

GitHub PoC

The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attac

CVE-2024-1207CRITICAL08 Oct 2024

Booking Calendar <= 9.9 - Unauthenticated SQL Injection

48RISK

open ↗

GitHub PoC

bka/magento-cve-2024-34102-exploit-cosmicstring

CVE-2024-34102CRITICALunder attack08 Oct 2024

XXE can expose crypt key and other secrets granting full admin access

100RISK

open ↗

GitHub PoC★ 1

Proof of Concept for the Log4Shell vulnerability (CVE-2021-44228), developed as part of the coursework for the curricular unit TPAS in the Master's degree in Information Security at FCUP.

CVE-2021-44228CRITICALunder attackransomware08 Oct 2024

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

wargame, CVE-2024-4367

CVE-2024-4367MEDIUM08 Oct 2024

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RISK

open ↗

GitHub PoC★ 83

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit

CVE-2024-45409CRITICAL07 Oct 2024

The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

53RISK

open ↗

GitHub PoC★ 1

Automated Exploit for CVE-2020-6287

CVE-2020-6287CRITICALunder attack07 Oct 2024

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication c

100RISK

open ↗

GitHub PoC★ 4

is a PoC tool demonstrating an exploit for a known vulnerability in the WebDAV component of IIS6

CVE-2017-7269CRITICALunder attack06 Oct 2024

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in

100RISK

open ↗

GitHub PoC★ 4

is a PoC tool designed to exploit an authenticated Remote Code Execution (RCE) vulnerability in specific versions of PostgreSQL (9.3 - 11.7)

CVE-2019-9193—06 Oct 2024

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve

60RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.