Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC★ 11

POC for CVE-2023-29360

CVE-2023-29360HIGHunder attack31 Aug 2024

Microsoft Streaming Service Elevation of Privilege Vulnerability

76RISK

open ↗

GitHub PoC

Proof of Concept Exploit for CVE-2024-44812 - SQL Injection Authentication Bypass vulnerability in Online Complaint Site v1.0

CVE-2024-44812CRITICAL31 Aug 2024

SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the usern

48RISK

open ↗

GitHub PoC★ 25

CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC

CVE-2024-21413CRITICALunder attack31 Aug 2024

Microsoft Outlook Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 43

CVE-2024-38063 is a critical security vulnerability in the Windows TCP/IP stack that allows for remote code execution (RCE)

CVE-2024-38063CRITICAL31 Aug 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC★ 23

Proof of concept : CVE-2024-1071: WordPress Vulnerability Exploited

CVE-2024-1071CRITICAL30 Aug 2024

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi

85RISK

open ↗

GitHub PoC★ 35

sinsinology/CVE-2024-6670

CVE-2024-6670CRITICALunder attackransomware30 Aug 2024

WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

100RISK

open ↗

GitHub PoC

A POC demo on CVE-2023-38831

CVE-2023-38831HIGHunder attackransomware30 Aug 2024

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISK

open ↗

GitHub PoC★ 140

exploits for CVE-2024-20017

CVE-2024-20017CRITICAL30 Aug 2024

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote cod

60RISK

open ↗

GitHub PoC★ 297

tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含

CVE-2020-1938CRITICALunder attack29 Aug 2024

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

100RISK

open ↗

GitHub PoC★ 1

In an era where digital security is crucial, a new vulnerability in OpenSSH, identified as CVE-2024-6387, has drawn the attention of system administrators and security professionals worldwide. Named "regreSSHion," this severe security flaw allows remote code execution (RCE) and could significant threat to the integrity of vulnerable systems.

CVE-2024-6387HIGH29 Aug 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC★ 7

Fully automated PoC - CVE-2024-25641 - RCE - Cacti < v1.2.26 🌵

CVE-2024-25641CRITICAL29 Aug 2024

Cacti RCE vulnerability when importing packages

85RISK

open ↗

GitHub PoC★ 83

mistymntncop/CVE-2024-5274

CVE-2024-5274HIGHunder attack29 Aug 2024

Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside

71RISK

open ↗

GitHub PoC★ 3

CVE-2019-15107 Webmin unauthenticated RCE

CVE-2019-15107CRITICALunder attackransomware29 Aug 2024

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

open ↗

GitHub PoC★ 297

tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含

CVE-2017-12615HIGHunder attackransomware29 Aug 2024

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati

100RISK

open ↗

GitHub PoC

LuisMateo1/Arbitrary-File-Read-CVE-2024-24919

CVE-2024-24919HIGHunder attackransomware29 Aug 2024

Information disclosure

100RISK

open ↗

GitHub PoC★ 4

Windows TCP/IP IPv6(CVE-2024-38063)

CVE-2024-38063CRITICAL28 Aug 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC★ 2

This Python script checks for the CVE-2024-6387 vulnerability in OpenSSH servers. It supports multiple IP addresses, URLs, CIDR ranges, and ports. The script can also read addresses from a file.

CVE-2024-6387HIGH28 Aug 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC★ 2

Remotely Exploiting The Kernel Via IPv6

CVE-2024-38063CRITICAL28 Aug 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC★ 7

potential memory corruption vulnerabilities in IPv6 networks.

CVE-2024-38063CRITICAL28 Aug 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC★ 3

Apache OFBiz CVE-2024-38856

CVE-2024-38856HIGHunder attack28 Aug 2024

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

100RISK

open ↗

GitHub PoC★ 6

This exploit will attempt to execute system commands on SPIP targets.

CVE-2024-7954CRITICAL28 Aug 2024

SPIP porte_plume Plugin Arbitrary PHP Execution

85RISK

open ↗

GitHub PoC★ 2

D0rDa4aN919/CVE-2023-22809-Exploiter

CVE-2023-22809HIGH28 Aug 2024

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen

68RISK

open ↗

GitHub PoC★ 1

【Teedy 1.11】Account Takeover via XSS

CVE-2024-46278HIGH28 Aug 2024

Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.

41RISK

open ↗

GitHub PoC

Apache: a Mainstream Web Service Turned a Vector of Attack for Remote Code Execution

CVE-2021-41773HIGHunder attackransomware28 Aug 2024

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

open ↗

GitHub PoC

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

CVE-2024-7593CRITICALunder attack28 Aug 2024

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remo

100RISK

open ↗

GitHub PoC★ 4

Jelly Template Injection Vulnerability in ServiceNow | POC CVE-2024-4879

CVE-2024-4879CRITICALunder attack27 Aug 2024

Jelly Template Injection Vulnerability in ServiceNow UI Macros

100RISK

open ↗

GitHub PoC★ 3

CVE-2023-41425 - Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

CVE-2023-41425MEDIUM27 Aug 2024

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code

60RISK

open ↗

GitHub PoC★ 7

PoC for the CVE-2024 Litespeed Cache Privilege Escalation

CVE-2024-28000CRITICAL27 Aug 2024

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

75RISK

open ↗

GitHub PoC

zxybfq/CVE-2021-4034

CVE-2021-4034HIGHunder attackransomware27 Aug 2024

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

open ↗

GitHub PoC★ 20

patchpoint/CVE-2024-38063

CVE-2024-38063CRITICAL27 Aug 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.