Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC

This Rust Code is designed to check SSH servers for the CVE-2024-6387 vulnerability

CVE-2024-6387HIGH09 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC★ 103

This Python script checks for the CVE-2024-6387 vulnerability in OpenSSH servers. It supports multiple IP addresses, URLs, CIDR ranges, and ports. The script can also read addresses from a file.

CVE-2024-6387HIGH09 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC

foudadev/CVE-2007-2447

CVE-2007-2447—09 Jul 2024

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISK

open ↗

GitHub PoC★ 7

alperenugurlu/CVE-2024-3596-Detector

CVE-2024-3596CRITICAL09 Jul 2024

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

53RISK

open ↗

GitHub PoC★ 11

Exploit for CVE-2024-4883

CVE-2024-4883CRITICAL08 Jul 2024

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

60RISK

open ↗

GitHub PoC★ 4

This is an Exploit for Unrestricted file upload in big file upload functionality in Chamilo-LMS for this location "/main/inc/lib/javascript/bigupload/inc/bigUpload.php" in Chamilo LMS <= v1.11.24, and Attackers can obtain remote code execution via uploading of web shell.

CVE-2023-4220HIGH08 Jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISK

open ↗

GitHub PoC★ 17

Exploit for CVE-2024-4885

CVE-2024-4885CRITICALunder attack08 Jul 2024

WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 199

Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)

CVE-2024-6387HIGH08 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC★ 4

PIN-based Authentication Bypass vulnerability in Kaiten

CVE-2024-41276CRITICAL08 Jul 2024

A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism

48RISK

open ↗

GitHub PoC

Chef Inspec profile for checking regreSSHion vulnerability CVE-2024-6387

CVE-2024-6387HIGH08 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC

This is a exploit for CVE-2007-2447; Vulnerable SMB

CVE-2007-2447—08 Jul 2024

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISK

open ↗

GitHub PoC

poc for CVE-2024-34102

CVE-2024-34102CRITICALunder attack08 Jul 2024

XXE can expose crypt key and other secrets granting full admin access

100RISK

open ↗

GitHub PoC

sysonlai/CVE-2024-32002-hook

CVE-2024-32002CRITICAL07 Jul 2024

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RISK

open ↗

GitHub PoC

RCE Chamilo 1.11.24

CVE-2023-4220HIGH07 Jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISK

open ↗

GitHub PoC★ 1

Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.

CVE-2023-4220HIGH07 Jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISK

open ↗

GitHub PoC★ 5

This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220

CVE-2023-4220HIGH07 Jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISK

open ↗

GitHub PoC

CosmicSting (CVE-2024-34102) POC / Patch Validator

CVE-2024-34102CRITICALunder attack07 Jul 2024

XXE can expose crypt key and other secrets granting full admin access

100RISK

open ↗

GitHub PoC★ 1

Chamilo LMS Unauthenticated Remote Code Execution

CVE-2023-4220HIGH07 Jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISK

open ↗

GitHub PoC

YISF 2024 CTF-Web (Directory Traversal via ".tar" file, CVE-2007-4559), easy

CVE-2007-4559CRITICAL07 Jul 2024

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows

53RISK

open ↗

GitHub PoC

This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220

CVE-2023-4220HIGH07 Jul 2024

Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

78RISK

open ↗

GitHub PoC★ 7

PoC - PHP CGI Argument Injection CVE-2024-4577 (Scanner and Exploit)

CVE-2024-4577CRITICALunder attackransomware06 Jul 2024

Argument Injection in PHP-CGI

100RISK

open ↗

GitHub PoC★ 56

Remote Code Execution (RCE) Vulnerability In Evaluating Property Name Expressions with multies ways to exploit

CVE-2024-36401CRITICALunder attack06 Jul 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RISK

open ↗

GitHub PoC★ 392

HikvisionExploiter is a Python-based utility designed to automate exploitation and directory accessibility checks on Hikvision network cameras exploiting the Web interface Version 3.1.3.150324 + CVE-2021-36260 Detection

CVE-2021-36260CRITICALunder attack05 Jul 2024

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

100RISK

open ↗

GitHub PoC★ 44

该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。

CVE-2024-30088HIGHunder attackransomware05 Jul 2024

Windows Kernel Elevation of Privilege Vulnerability

83RISK

open ↗

GitHub PoC★ 1

Exploiter a Vulnerability detection and Exploitation tool for GeoServer Unauthenticated Remote Code Execution CVE-2024-36401.

CVE-2024-36401CRITICALunder attack05 Jul 2024

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

100RISK

open ↗

GitHub PoC★ 10

HASSH fingerprints for identifying OpenSSH servers potentially vulnerable to CVE-2024-6387 (regreSSHion).

CVE-2024-6387HIGH05 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC

imv7/CVE-2024-6387

CVE-2024-6387HIGH05 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC★ 1

Quick regreSSHion checker (based on software version) for nuclei CVE-2024-6387

CVE-2024-6387HIGH05 Jul 2024

Openssh: regresshion - race condition in ssh allows rce/dos

63RISK

open ↗

GitHub PoC★ 1

TeamCity RCE for Linux (CVE-2023-42793)

CVE-2023-42793CRITICALunder attackransomware05 Jul 2024

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

100RISK

open ↗

GitHub PoC★ 2

SSH EXPLOIT BYPASS AUTH SSH

CVE-2024-3094CRITICAL05 Jul 2024

Xz: malicious code in distributed source

70RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.