Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,496cataloged exploits

34,964CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 13,937VulnCheck XDB 8,510Nuclei 4,239Metasploit 3,468✓ verified onlyrecent popular risk

13,937 exploits

GitHub PoC★ 38

log4j2 RCE漏洞（CVE-2021-44228)内网扫描器，可用于在不出网的条件下进行漏洞扫描，帮助企业内部快速发现Log4jShell漏洞。

CVE-2021-44228CRITICALunder attackransomware20 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

bumheehan/cve-2021-44228-log4j-test

CVE-2021-44228CRITICALunder attackransomware20 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 2

log4j2 Log4Shell CVE-2021-44228 proof of concept

CVE-2021-44228CRITICALunder attackransomware20 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

a project written in go and java i abandoned for CVE-2021-44228 try to fix it if you can XD

CVE-2021-44228CRITICALunder attackransomware20 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 5

Identifying all log4j components across on local windows servers. CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 4

Vulnerability analysis, patch management and exploitation tool forCVE-2021-44228 / CVE-2021-45046 / CVE-2021-4104

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

An Inspec profile to check for Log4j CVE-2021-44228 and CVE-2021-45046

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

kkyehit/log4j_CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 8

A Proof of Concept of the Log4j vulnerabilities (CVE-2021-44228) over Java-RMI

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 106

Exploiting CVE-2021-44228 in vCenter for remote code execution and more.

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 7

Demo to show how Log4Shell / CVE-2021-44228 vulnerability works

CVE-2021-44228CRITICALunder attackransomware19 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 65

CVE-2021-40444

CVE-2021-40444HIGHunder attackransomware19 Dec 2021

Microsoft MSHTML Remote Code Execution Vulnerability

100RISK

GitHub PoC

This is a showcase how the Log4J vulnerability (CVE-2021-44228) could be explored. This code is safe to run, but understand what it does and how it works!

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

Log4Shell (CVE-2021-44228) docker lab

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

A fun activity using a packet capture file from the log4j exploit (CVE-2021-44228)

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 194

shmilylty/cve-2021-22005-exp

CVE-2021-22005CRITICALunder attackransomware18 Dec 2021

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw

100RISK

GitHub PoC

Self-contained lab environment that runs the exploit safely, all from docker compose

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

A scanning suite to find servers affected by the log4shell flaw (CVE-2021-44228) with example to test it

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

An attempt to understand the log4j vulnerability by looking through the code

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

can find, analyse and patch Log4J files because of CVE-2021-44228, CVE-2021-45046

CVE-2021-44228CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

ludy-dev/cve-2021-45046

CVE-2021-45046CRITICALunder attackransomware18 Dec 2021

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

100RISK

GitHub PoC★ 1

Provide patched version of Log4J against CVE-2021-44228 and CVE-2021-45046 as well as a script to manually patch it yourself

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 9

This project will help to test the Log4j CVE-2021-44228 vulnerability.

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 5

Docker images and k8s YAMLs for Log4j Vulnerability POC (Log4j (CVE-2021-44228 RCE Vulnerability)

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

nu11secur1ty/CVE-2021-44228-VULN-APP

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

A simple simulation of the infamous CVE-2021-44228 issue.

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 9

A lab demonstration of the log4shell vulnerability: CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

A simple script to remove Log4J JndiLookup.class from jars in a given directory, to temporarily protect from CVE-2021-45046 and CVE-2021-44228.

CVE-2021-45046CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

100RISK

GitHub PoC

Test exploit of CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware17 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.