Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
18,044 exploits
GitHub PoC
zerobytesecure/CVE-2019-19781
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th
100RISK
open ↗GitHub PoC★ 1
Proof of concept of CVE-2024-29868 affecting Apache StreamPipes from 0.69.0 through 0.93.0
Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
63RISK
open ↗GitHub PoC★ 1
This is an Incident Response Walkthrough: Mitigating a Zero-Day Attack (CVE-2024-4577)
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 290
tykawaii98/CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
83RISK
open ↗GitHub PoC
CVE-2018-9995
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RISK
open ↗GitHub PoC★ 45
Exploit for the CVE-2024-5806
MOVEit Transfer Authentication Bypass Vulnerability
85RISK
open ↗GitHub PoC
PoC and analysis for Kibana Prototype Pollution RCE (CVE-2019-7609).
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker
100RISK
open ↗GitHub PoC★ 40
tykawaii98/CVE-2024-21338_PoC
Windows Kernel Elevation of Privilege Vulnerability
83RISK
open ↗GitHub PoC★ 2
☣️ This repository contains the description and a proof of concept for CVE-2024-34313
An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a pu
48RISK
open ↗GitHub PoC★ 4
Exploit for CVE-2024-28999 SolarWinds Platform Race Condition Vulnerability - login page
SolarWinds Platform Race Condition Vulnerability
38RISK
open ↗GitHub PoC★ 10
POC for CVE-2024-31982: XWiki Platform Remote Code Execution > 14.10.20
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC
A tool for vulnerability detection and exploitation tool for CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC★ 1
NanoWraith/CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC
CVE-2023-23397: Remote Code Execution Vulnerability in Microsoft Outlook
Microsoft Outlook Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC
PoC and Bulk Scanner for CVE-2024-29973
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗GitHub PoC★ 5
PoC of CVE-2024-37759
DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerabi
48RISK
open ↗GitHub PoC★ 6
Exploiter a Vulnerability detection and Exploitation tool for CVE-2024-29973 with Asychronous Performance.
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗GitHub PoC
phanthibichtram12/CVE-2022-1565
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
46RISK
open ↗GitHub PoC
CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a
48RISK
open ↗GitHub PoC★ 3
This is a Python 3 version of this exploit. Hope it works!!!
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗GitHub PoC★ 1
WanLiChangChengWanLiChang/CVE-2024-29972
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326
85RISK
open ↗GitHub PoC★ 1
rdoix/cve-2024-21762-checker
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0
100RISK
open ↗GitHub PoC★ 10
NanoWraith/CVE-2024-29973
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗GitHub PoC
CVE-2023-2825 exploit script
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RISK
open ↗GitHub PoC★ 6
This script is a modified version of the original exploit by Daniele Scanu which exploits an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.10 (CVE-2019-9053).
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗GitHub PoC★ 4
CVE-2024-29275.yaml
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code an
48RISK
open ↗GitHub PoC★ 6
PoC - Prueba de Concepto de CVE-2024-4367 en conjunto al CVE-2023-38831 en un solo Script
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
CVE-2022-22947 exploit script
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC★ 73
CVE-2024-28397: js2py sandbox escape, bypass pyimport restriction.
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.