Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,871cataloged exploits
40,961CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,446VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
88,871 exploits
GitHub PoC
nimesh895/Malware-Analysis-Follina-CVE-2022-30190
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
This Poc demonstrate Arbitrary read/write primitives provided by CVE-2025-7771
Code Execution / Escalation of Privileges in ThrottleStop
41RISK
open ↗VulnCheck XDB
remote-with-credentials
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISK
open ↗GitHub PoC★ 1
CVE-2017-7921, CVE-2021-36260 updated 21/01/2026
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗GitHub PoC★ 12
A small docker lab to play with cve-2026-24061, the inetutils-telnetd authentication bypass.
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISK
open ↗GitHub PoC
SMBv1: CVE-2017-0143, gravedad 8.8, de ejecucion remota de codigo (RCE), en Windows con SMBv1 (ms17-010)
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗GitHub PoC★ 3
海康威视RCE漏洞 批量检测和利用工具
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗GitHub PoC
CybersRMUTL/CVE-2019-9193-Postgresql-RCE
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISK
open ↗GitHub PoC
abanop22333/Apache-Authentication-Flaw-Research-CVE-2024-38476-
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
60RISK
open ↗GitHub PoC★ 1
InfoSecAntara/CVE-2025-14847-MongoDB
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC
afifudinmtop/CVE-2021-21425
Unauthenticated Arbitrary YAML Write/Update leads to Code Execution
85RISK
open ↗GitHub PoC
React Router's createFileSessionStorage() in certain versions allows unsigned cookies to be manipulated, enabling file system access outside the session directory.
React Router has Path Traversal in File Session Storage
53RISK
open ↗GitHub PoC★ 1
Final Project in Fundamental network security,POC CVE-202438063
Windows TCP/IP Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
CybersRMUTL/CVE-2019-10149-Exim4-RCE
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
open ↗GitHub PoC
MOVEit Transfer 2023 mass data breach (CVE-2023-34362)
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RISK
open ↗VulnCheck XDB
local
The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process
33RISK
open ↗VulnCheck XDB
initial-access
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗GitHub PoC
Spring4Shell (CVE-2022-22965) DFIR lab with exploit simulation, Python WAF, IOC-based detection, and PCAP analysis.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗GitHub PoC
This script is used to identify MongoDB services that are network-exposed and allow unauthenticated protocol handshakes.
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 8
CVE-2026-23744 - Versions 1.4.2 and earlier of MCPJam inspector are vulnerable to remote code execution (RCE). Because the tool listens on 0.0.0.0 by default, an attacker can trigger the installation and execution of a malicious MCP server by sending a crafted HTTP request. Version 1.4.3 contains a patch for this issue.
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗VulnCheck XDB
initial-access
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISK
open ↗VulnCheck XDB
initial-access
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISK
open ↗GitHub PoC
dragosbanica/CVE-2023-0386_POC
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa
86RISK
open ↗VulnCheck XDB
local
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa
86RISK
open ↗VulnCheck XDB
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 5
A tool designed to exploit CVE-2025-54068 and Remote Command Execution of the Livewire project.
Livewire vulnerable to remote command execution during property update hydration
100RISK
open ↗VulnCheck XDB
initial-access
Livewire vulnerable to remote command execution during property update hydration
100RISK
open ↗GitHub PoC
CVE-2025-55182 React Server Components Remote Code Execution Exploit Lab
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Vladjrfhfg/React-site-CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.