Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
18,044 exploits
GitHub PoC
TikiWiki CMS Groupware v8.3 - Open Redirect
tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frame
43RISK
open ↗GitHub PoC★ 2
Exploit for CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC★ 1
qinzhu111/uWSGI-CVE-2018-7490-POC
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversa
50RISK
open ↗GitHub PoC★ 20
PoC for the Veeam Recovery Orchestrator Authentication CVE-2024-29855
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
53RISK
open ↗GitHub PoC★ 12
PDF.js是由Mozilla维护的基于JavaScript的PDF查看器。此漏洞允许攻击者在打开恶意 PDF 文件后立即执行任意 JavaScript 代码。这会影响所有 Firefox 用户 （<126），因为 Firefox 使用 PDF.js 来显示 PDF 文件，但也严重影响了许多基于 Web 和 Electron 的应用程序，这些应用程序（间接）使用 PDF.js 进行预览功能。
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
Fix for CVE-2018-15473
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗GitHub PoC
Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051)
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
48RISK
open ↗GitHub PoC
WanLiChangChengWanLiChang/CVE-2024-23692-RCE
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 4
Fixed and minimalist PoC of the CVE-2024-4577
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
Valve Press - CVE-2024-27956-RCE - SQL Injection
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC★ 17
Unauthenticated RCE Flaw in Rejetto HTTP File Server (CVE-2024-23692)
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 12
vanboomqi/CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 1
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
75RISK
open ↗GitHub PoC
raytran54/CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
Rejetto http File Server 2.3.x (Reverse shell)
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC★ 2
POC for CVE-2024-4577 with Shodan integration
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 4
jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗GitHub PoC★ 25
Ivanti EPM SQL Injection Remote Code Execution Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗GitHub PoC
Vietnam National Cyber Security (NCS)'s Internship - 2nd Test
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
CVE-2022-36446 POC 실습
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗GitHub PoC
Basic POC to test CVE-2024-3094 vulnerability inside K8s cluster
Xz: malicious code in distributed source
70RISK
open ↗GitHub PoC
PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 4
NanoWraith/CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 29
CVE-2024-37051 poc and exploit
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.