Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC

GalloLuigi/Analisi-CVE-2017-5715

CVE-2017-5715MEDIUM06 May 2024

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl

55RISK

open ↗

GitHub PoC★ 7

LINKSYS AC1900 EA7500v3 IGD UPnP Stack Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-46012CRITICAL06 May 2024

Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP

48RISK

open ↗

GitHub PoC★ 1

An issue in HSC Cybersecurity HSC Mailinspector version 5.2.17-3 has been identified, allowing a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component.

CVE-2024-32370CRITICAL06 May 2024

An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive info

48RISK

open ↗

GitHub PoC

Turvanõrkuse CVE 2024 3273 analüüs: D-Link seadmete käsusüst

CVE-2024-3273HIGHunder attack05 May 2024

D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

100RISK

open ↗

GitHub PoC★ 1

FoxyProxys/CVE-2024-27956

CVE-2024-27956CRITICAL05 May 2024

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

85RISK

open ↗

GitHub PoC★ 2

PoC for the Untrusted Pointer Dereference in the appid.sys driver

CVE-2024-21338HIGHunder attackransomware05 May 2024

Windows Kernel Elevation of Privilege Vulnerability

83RISK

open ↗

GitHub PoC

Vignesh2712/Automation-for-Juniper-cve-2023-36845

CVE-2023-36845CRITICALunder attack04 May 2024

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

open ↗

GitHub PoC★ 1

Joomla! v4.2.8 - Unauthenticated information disclosure

CVE-2023-23752MEDIUMunder attack04 May 2024

[20230201] - Core - Improper access check in webservice endpoints

100RISK

open ↗

GitHub PoC

Bypass for CVE-2007-4559 Trellix patch

CVE-2007-4559CRITICAL03 May 2024

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows

53RISK

open ↗

GitHub PoC★ 7

Exploit for Microsoft SmartScreen malicious execution (april 2024)

CVE-2024-29988HIGHunder attack03 May 2024

SmartScreen Prompt Security Feature Bypass Vulnerability

83RISK

open ↗

GitHub PoC★ 7

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

CVE-2024-4040CRITICALunder attack03 May 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RISK

open ↗

GitHub PoC★ 2

CVE-2024-21413 Microsoft Outlook RCE Exploit

CVE-2024-21413CRITICALunder attack03 May 2024

Microsoft Outlook Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC

CVE-2024-27956 WORDPRESS RCE PLUGIN

CVE-2024-27956CRITICAL03 May 2024

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

85RISK

open ↗

GitHub PoC★ 1

Jenkins CVE-2024-23897: Arbitrary File Read Vulnerability

CVE-2024-23897CRITICALunder attackransomware03 May 2024

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

open ↗

GitHub PoC

xsxtw/CVE-2019-0232

CVE-2019-0232—02 May 2024

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0

60RISK

open ↗

GitHub PoC

ShellUnease/CVE-2024-34833-payroll-management-system-rce

CVE-2024-34833CRITICAL02 May 2024

Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. Users can upload images via the "save_settin

48RISK

open ↗

GitHub PoC

xsxtw/CVE-2022-26134

CVE-2022-26134CRITICALunder attackransomware02 May 2024

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

GitHub PoC

xsxtw/SpringFramework_CVE-2022-22965_RCE

CVE-2022-22965CRITICALunder attack01 May 2024

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC

xsxtw/CVE-2022-0847

CVE-2022-0847HIGHunder attack01 May 2024

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

open ↗

GitHub PoC

PoC for CVE-2023-32749 affecting Pydio Cells

CVE-2023-32749HIGH01 May 2024

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying t

46RISK

open ↗

GitHub PoC★ 4

jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability

CVE-2024-4040CRITICALunder attack01 May 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RISK

open ↗

GitHub PoC

Neo-XeD/CVE-2024-33775

CVE-2024-33775HIGH01 May 2024

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a cr

41RISK

open ↗

GitHub PoC

tronghoang89/cve-2019-16113

CVE-2019-16113—01 May 2024

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j

60RISK

open ↗

GitHub PoC★ 90

PoC for SQL Injection in CVE-2024-27956

CVE-2024-27956CRITICAL01 May 2024

WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

85RISK

open ↗

GitHub PoC★ 5

A remote code execution vulnerability exists in the iControl REST API feature of F5's BIG-IP product. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges.

CVE-2022-1388CRITICALunder attackransomware30 Apr 2024

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

GitHub PoC★ 5

Exploit CrushFTP CVE-2024-4040

CVE-2024-4040CRITICALunder attack30 Apr 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RISK

open ↗

GitHub PoC

CCIEVoice2009/CVE-2024-1086

CVE-2024-1086HIGHunder attackransomware30 Apr 2024

Use-after-free in Linux kernel's netfilter: nf_tables component

76RISK

open ↗

GitHub PoC

Update of https://github.com/1337g/CVE-2017-12149 to work with python3

CVE-2017-12149CRITICALunder attackransomware30 Apr 2024

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter

100RISK

open ↗

GitHub PoC

Exploit for CVE-2024-4040 affecting CrushFTP server in all versions before 10.7.1 and 11.1.0 on all platforms

CVE-2024-4040CRITICALunder attack29 Apr 2024

Unauthenticated arbitrary file read and remote code execution in CrushFTP

100RISK

open ↗

GitHub PoC

A simple bash script to exploit Joomla! < 4.2.8 - Unauthenticated information disclosure

CVE-2023-23752MEDIUMunder attack28 Apr 2024

[20230201] - Core - Improper access check in webservice endpoints

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.