Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,496cataloged exploits

34,964CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 13,937VulnCheck XDB 8,510Nuclei 4,239Metasploit 3,468✓ verified onlyrecent popular risk

13,937 exploits

GitHub PoC★ 8

This demonstration video shows how we can control the victim's device by sending the innocent-looking PDF file to the target which actually consists of embedded payload. The exploit was made public as CVE-2010-1240.

CVE-2010-1240—26 Jan 2022

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of

60RISK

GitHub PoC★ 2,044

CVE-2021-4034 1day

CVE-2021-4034HIGHunder attack25 Jan 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

GitHub PoC★ 27

Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion

CVE-2022-21371HIGH25 Jan 2022

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported ve

78RISK

GitHub PoC★ 46

numanturle/CVE-2022-0332

CVE-2022-0332—25 Jan 2022

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web serv

35RISK

GitHub PoC

Exploit-WordPress Plugin The True Ranker 2.2.2 - Arbitrary File Read

CVE-2021-39312HIGH24 Jan 2022

True Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read

78RISK

GitHub PoC★ 2

Strapi CMS 3.0.0-beta.17.4 - Unauthenticated Remote Code Execution (CVE-2019-18818, CVE-2019-19609)

CVE-2019-19609—23 Jan 2022

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

GitHub PoC★ 29

CVE-2022-21907 Vulnerability PoC

CVE-2022-21907CRITICAL23 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC★ 1

jcarabantes/CVE-2022-23046

CVE-2022-23046—22 Jan 2022

PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a su

28RISK

GitHub PoC★ 5

test 反向辣鸡数据投放 CVE-2022-23305 工具利用教程 Exploit POC

CVE-2022-23305CRITICAL21 Jan 2022

SQL injection in JDBC Appender in Apache Log4j V1

60RISK

GitHub PoC★ 24

💀 Linux local root exploit for CVE-2018-18955

CVE-2018-18955—19 Jan 2022

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat

38RISK

GitHub PoC★ 375

CVE-2022-0185

CVE-2022-0185HIGHunder attack19 Jan 2022

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio

76RISK

GitHub PoC★ 361

HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

CVE-2022-21907CRITICAL17 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC

KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability

CVE-2016-5195HIGHunder attack17 Jan 2022

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 83

Proof of concept of CVE-2022-21907 Double Free in http.sys driver, triggering a kernel crash on IIS servers

CVE-2022-21907CRITICAL17 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC

A Java application intentionally vulnerable to CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware16 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 26

CVE-2022-21907: detection, protection, exploitation and demonstration. Exploitation: Powershell, Python, Ruby, NMAP and Metasploit. Detection and protection: Powershell. Demonstration: Youtube.

CVE-2022-21907CRITICAL15 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC★ 1

cf8-upload.py | CVE-2009-2265

CVE-2009-2265—14 Jan 2022

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil

60RISK

GitHub PoC

CVE-2020-15261 test

CVE-2020-15261HIGH12 Jan 2022

Unquoted service path vulnerability on Veyon

46RISK

GitHub PoC★ 5

cve-2022-21907

CVE-2022-21907CRITICAL11 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC

Veids/CVE-2020-3452_auto

CVE-2020-3452HIGHunder attack10 Jan 2022

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

100RISK

GitHub PoC★ 5

lsw29475/CVE-2020-9715

CVE-2020-9715HIGHunder attack10 Jan 2022

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.3

83RISK

GitHub PoC★ 2

h3x0v3rl0rd/CVE-2018-16763

CVE-2018-16763—08 Jan 2022

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISK

GitHub PoC★ 2

Log4jshell - CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware07 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

alexpena5635/CVE-2021-44228_scanner-main-Modified-

CVE-2021-44228CRITICALunder attackransomware05 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

Bassmaster Plugin NodeJS RCE

CVE-2014-7205—04 Jan 2022

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

60RISK

GitHub PoC

the name of virus is the detection of microsoft defender, is the tipic antivirus

CVE-2017-0147HIGHunder attackransomware04 Jan 2022

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

GitHub PoC

Atmail XSS-CSRF-RCE Exploit Chain

CVE-2012-2593—04 Jan 2022

Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote atta

23RISK

GitHub PoC

the name of virus is the detection of microsoft defender, is the tipic antivirus

CVE-2012-0158HIGHunder attack03 Jan 2022

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls

100RISK

GitHub PoC

Log4j2 LDAP 취약점 테스트 (CVE-2021-44228)

CVE-2021-44228CRITICALunder attackransomware03 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 9

darkpills/CVE-2021-25094-tatsu-preauth-rce

CVE-2021-25094—03 Jan 2022

Tatsu < 3.3.12 - Unauthenticated RCE

60RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.