Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC

poc of cve-2024-8752(WebIQ 2.15.9)

CVE-2024-8752CRITICAL19 Sep 2024

WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability

68RISK

open ↗

GitHub PoC

CVE-2023-47253 | Qualitor <= 8.20 RCE

CVE-2023-47253CRITICAL19 Sep 2024

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reques

68RISK

open ↗

GitHub PoC

CVE-2023-47253 | Qualitor <= 8.20 RCE

CVE-2023-47253CRITICAL19 Sep 2024

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reques

68RISK

open ↗

GitHub PoC★ 2

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

CVE-2024-8522CRITICAL19 Sep 2024

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

75RISK

open ↗

GitHub PoC★ 4

CVE-2022-23131 Zabbix Server SAML authentication exploit

CVE-2022-23131CRITICALunder attack18 Sep 2024

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

100RISK

open ↗

GitHub PoC

safeer-accuknox/CrushFTP-cve-2024-4040-poc

CVE-2024-4040CRITICALunder attack18 Sep 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RISK

open ↗

GitHub PoC★ 2

0xAgun/CVE-2024-2876

CVE-2024-2876CRITICAL17 Sep 2024

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

85RISK

open ↗

GitHub PoC★ 3

Client Implementation for the WatchGuard SSO Agent Protocol used for Security Research (CVE-2024-6592, CVE-2024-6593, CVE-2024-6594)

CVE-2024-6592CRITICAL17 Sep 2024

WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

48RISK

open ↗

GitHub PoC★ 2

The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads

CVE-2024-43160CRITICAL17 Sep 2024

WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability

63RISK

open ↗

GitHub PoC★ 1

PoC code for vulnerability in webmod v0.48. Originally written in 2007, assigned CVE-2007-1260.

CVE-2007-1260—16 Sep 2024

Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execut

23RISK

open ↗

GitHub PoC★ 16

CVE-2024-8190: Ivanti Cloud Service Appliance Command Injection

CVE-2024-8190HIGHunder attack16 Sep 2024

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo

93RISK

open ↗

GitHub PoC★ 4

Server-Side Template Injection Exploit

CVE-2024-32651CRITICAL16 Sep 2024

Server Side Template Injection in Jinja2 allows Remote Command Execution

85RISK

open ↗

GitHub PoC★ 4

Proof Of Concept for CVE-2023-21716 Microsoft Word Heap Corruption

CVE-2023-21716CRITICAL16 Sep 2024

Microsoft Word Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC

Exploit a 2021 Kernel vulnerability in Ubuntu to become root almost instantly!

CVE-2021-3493HIGHunder attack16 Sep 2024

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

98RISK

open ↗

GitHub PoC★ 3

CVE-2024-44000-LiteSpeed-Cache

CVE-2024-44000CRITICAL16 Sep 2024

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

85RISK

open ↗

GitHub PoC★ 49

This repository contains PoC for CVE-2024-7965. This is the vulnerability in the V8 that occurs only within ARM64.

CVE-2024-7965HIGHunder attack16 Sep 2024

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially expl

76RISK

open ↗

GitHub PoC

New exploit for pyLoad v0.5.0 - Unauthenticated remote code excecution

CVE-2023-0297CRITICAL15 Sep 2024

Code Injection in pyload/pyload

85RISK

open ↗

GitHub PoC★ 51

POC - Unauthenticated RCE Flaw in Rejetto HTTP File Server - CVE-2024-23692

CVE-2024-23692CRITICALunder attackransomware15 Sep 2024

Rejetto HTTP File Server 2.3m Unauthenticated RCE

100RISK

open ↗

GitHub PoC★ 54

Pre-Auth Exploit for CVE-2024-40711

CVE-2024-40711CRITICALunder attackransomware15 Sep 2024

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec

100RISK

open ↗

GitHub PoC★ 1

Unauthenticated remote code execution via Calibre’s content server in Calibre <= 7.14.0.

CVE-2024-6782CRITICAL15 Sep 2024

Calibre Remote Code Execution

85RISK

open ↗

GitHub PoC★ 2

dogucyber/WordPress-Exploit-CVE-2024-1071

CVE-2024-1071CRITICAL15 Sep 2024

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi

85RISK

open ↗

GitHub PoC★ 5

A Bash script for Kali Linux that exploits an iOS WebKit vulnerability (CVE-2020-27950) using Metasploit and ngrok. Automates payload delivery with a public URL via ngrok, checks for required tools, handles errors, and provides an easy way to crash browsers for educational purposes only.

CVE-2020-27950MEDIUMunder attack15 Sep 2024

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watch

68RISK

open ↗

GitHub PoC★ 19

Exploit for CVE-2024-29847

CVE-2024-29847CRITICAL14 Sep 2024

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows

60RISK

open ↗

GitHub PoC★ 2

chsxthwik/CVE-2024-2876

CVE-2024-2876CRITICAL14 Sep 2024

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

85RISK

open ↗

GitHub PoC★ 2

Robocopsita/CVE-2022-0944_RCE_POC

CVE-2022-0944CRITICAL13 Sep 2024

Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

48RISK

open ↗

GitHub PoC

0xWhoami35/CVE-2024-4879

CVE-2024-4879CRITICALunder attack13 Sep 2024

Jelly Template Injection Vulnerability in ServiceNow UI Macros

100RISK

open ↗

GitHub PoC

acidburn2049/CVE-2021-3156

CVE-2021-3156HIGHunder attack13 Sep 2024

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC

sshipanoo/CVE-2024-44542

CVE-2024-44542CRITICAL13 Sep 2024

SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.

48RISK

open ↗

GitHub PoC★ 3

Proof-of-Concept Exploit for CVE-2024-36401 GeoServer 2.25.1

CVE-2024-36401CRITICALunder attack13 Sep 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RISK

open ↗

GitHub PoC

🚨 Just completed a detailed investigation for Event ID 193: "SOC231 - Cisco IOS XE Web UI ZeroDay (CVE-2023-20198)" via @LetsDefend.io. The attacker successfully bypassed authentication, gaining admin control over the device! Immediate containment was critical. Stay vigilant! 💻🔐

CVE-2023-20198CRITICALunder attack13 Sep 2024

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.