Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
18,044 exploits
GitHub PoC★ 5
A proof of concept of traefik CVE to understand the impact
HTTP client can remove the X-Forwarded headers in Traefik
48RISK
open ↗GitHub PoC
d
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
open ↗GitHub PoC★ 8
Pgadmin4 Sensitive Information Exposure
OAuth2 client id and secret exposed through the web browser in pgAdmin 4
63RISK
open ↗GitHub PoC★ 3
A vulnerability scanner that searches for the CVE-2024-9166 vulnerability on websites, more info about this vulnerability here: https://www.tenable.com/cve/CVE-2024-9166
OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver
63RISK
open ↗GitHub PoC
p33d/CVE-2024-8275
The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
60RISK
open ↗GitHub PoC★ 5
PrusaSlicer Arbitrary Code Execution using .3mf
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrar
33RISK
open ↗GitHub PoC
CVE-2019-15107 webmin 취약점에 대해서 직접 서버를 구축하고 공격 결과를 남긴 정보입니다.
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISK
open ↗GitHub PoC
CVE-2024-46627 - Incorrect access control in BECN DATAGERRY v2.2 allows attackers to > execute arbitrary commands via crafted web requests.
Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
63RISK
open ↗GitHub PoC★ 7
Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
100RISK
open ↗GitHub PoC★ 147
CVE-2024-38200 & CVE-2024-43609 - Microsoft Office NTLMv2 Disclosure Vulnerability
Microsoft Office Spoofing Vulnerability
38RISK
open ↗GitHub PoC★ 3
WBW Product Table Pro <= 1.9.4 - Unauthenticated Arbitrary SQL Execution to RCE
WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability
48RISK
open ↗GitHub PoC★ 4
Proof-of-Concept for CVE-2024-47066
Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
53RISK
open ↗GitHub PoC★ 9
CVE-2024-7593 Ivanti Virtual Traffic Manager 22.2R1 / 22.7R2 Admin Panel Authentication Bypass PoC [EXPLOIT]
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo
100RISK
open ↗GitHub PoC★ 2
vidura2/CVE-2024-46377
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function
48RISK
open ↗GitHub PoC★ 5
TheCyberguy-17/RCE_CVE-2024-7954
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISK
open ↗GitHub PoC★ 2
vidura2/CVE-2024-46451
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the de
48RISK
open ↗GitHub PoC
CVE-2024-3273 - D-Link Remote Code Execution (RCE)
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
100RISK
open ↗GitHub PoC
WonderCMS RCE CVE-2023-41425
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code
60RISK
open ↗GitHub PoC★ 3
Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗GitHub PoC
Kode Eksploitasi CVE-2024-38063
Windows TCP/IP Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
btar1gan/exploit_CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗GitHub PoC★ 1
teamcity-exploit-cve-2023-42793
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISK
open ↗GitHub PoC
MAHajian/CVE-2019-9978
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio
100RISK
open ↗GitHub PoC
yashfren/CVE-2014-0160-HeartBleed
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
open ↗GitHub PoC
CVE-2023-47253 | Qualitor <= 8.20 RCE
Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reques
68RISK
open ↗GitHub PoC★ 6
POC_CVE-2024-46256
A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add
48RISK
open ↗GitHub PoC★ 1
Modification of: PoC of CVE-2019-14322: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
50RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.