Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,020cataloged exploits
35,276CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,446Referência 22,166GitHub PoC 14,080VulnCheck XDB 8,604Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
76,647 exploits
GitHub PoC★ 1
chsxthwik/CVE-2024-27954
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
85RISK
open ↗GitHub PoC★ 2
cve-2024-38821
Authorization Bypass of Static Resources in WebFlux Applications
48RISK
open ↗VulnCheck XDB
infoleak
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
85RISK
open ↗GitHub PoC
Writing one because the one I found isn't working
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code
60RISK
open ↗VulnCheck XDB
client-side
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18
41RISK
open ↗VulnCheck XDB
initial-access
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RISK
open ↗GitHub PoC★ 23
Exploit for CyberPanel Pre-Auth RCE via Command Injection
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RISK
open ↗GitHub PoC★ 4
Automatic Plugin for WordPress < 3.92.1 Multiples Vulnerabilities
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
85RISK
open ↗VulnCheck XDB
initial-access
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
85RISK
open ↗GitHub PoC★ 1
0xDTC/Prestashop-CVE-2024-34716
PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
60RISK
open ↗Metasploit600
Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a
48RISK
open ↗Metasploit600
Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a
68RISK
open ↗Metasploit600
Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload
File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the f
36RISK
open ↗GitHub PoC★ 2
Stack-Overflow on TendaAC8
Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c funct
48RISK
open ↗GitHub PoC
It's Proof of Concept on CVE-2024-24919-POC , i made it after it's discoverd
Information disclosure
100RISK
open ↗GitHub PoC
Refurbish
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISK
open ↗GitHub PoC
Refurbish Chamilo LMS CVE-2023-4220 exploit written in bash
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
78RISK
open ↗VulnCheck XDB
initial-access
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
78RISK
open ↗Metasploit600
CyberPanel Multi CVE Pre-auth RCE
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RISK
open ↗Metasploit600
CyberPanel Multi CVE Pre-auth RCE
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypas
100RISK
open ↗Metasploit600
CyberPanel Multi CVE Pre-auth RCE
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecut
75RISK
open ↗GitHub PoC
CVE-2023-41425 Refurbish
Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code
60RISK
open ↗GitHub PoC★ 18
Pyload RCE with js2py sandbox escape
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a
68RISK
open ↗GitHub PoC
CVE-2019-9053 rewritten in python3 to fix broken syntax. Affects CMS made simple <2.2.10
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗GitHub PoC★ 1
CVE-2022-0944 Remote Code Execution Exploit
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISK
open ↗GitHub PoC
tadash10/Detailed-Analysis-and-Mitigation-Strategies-for-CVE-2024-38124-and-CVE-2024-43468
Windows Netlogon Elevation of Privilege Vulnerability
48RISK
open ↗VulnCheck XDB
infoleak
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.