Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
76,647 exploits
GitHub PoC
PoC and analysis for Kibana Prototype Pollution RCE (CVE-2019-7609).
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker
100RISK
open ↗GitHub PoC★ 40
tykawaii98/CVE-2024-21338_PoC
Windows Kernel Elevation of Privilege Vulnerability
83RISK
open ↗GitHub PoC★ 2
☣️ This repository contains the description and a proof of concept for CVE-2024-34313
An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a pu
48RISK
open ↗GitHub PoC★ 4
Exploit for CVE-2024-28999 SolarWinds Platform Race Condition Vulnerability - login page
SolarWinds Platform Race Condition Vulnerability
38RISK
open ↗VulnCheck XDB
initial-access
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗VulnCheck XDB
initial-access
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗VulnCheck XDB
initial-access
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC
CVE-2023-23397: Remote Code Execution Vulnerability in Microsoft Outlook
Microsoft Outlook Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC
A tool for vulnerability detection and exploitation tool for CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC★ 1
NanoWraith/CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC★ 10
POC for CVE-2024-31982: XWiki Platform Remote Code Execution > 14.10.20
XWiki Platform: Remote code execution as guest via DatabaseSearch
75RISK
open ↗GitHub PoC
PoC and Bulk Scanner for CVE-2024-29973
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗GitHub PoC★ 5
PoC of CVE-2024-37759
DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerabi
48RISK
open ↗VulnCheck XDB
initial-access
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗VulnCheck XDB
initial-access
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗GitHub PoC
phanthibichtram12/CVE-2022-1565
Import any XML or CSV File to WordPress <= 3.6.7 - Admin+ Malicious File Upload
46RISK
open ↗VulnCheck XDB
remote-with-credentials
Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution
78RISK
open ↗GitHub PoC
CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a
48RISK
open ↗GitHub PoC★ 6
Exploiter a Vulnerability detection and Exploitation tool for CVE-2024-29973 with Asychronous Performance.
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗GitHub PoC★ 6
This script is a modified version of the original exploit by Daniele Scanu which exploits an unauthenticated SQL injection vulnerability in CMS Made Simple <= 2.2.10 (CVE-2019-9053).
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗VulnCheck XDB
infoleak
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RISK
open ↗GitHub PoC★ 1
rdoix/cve-2024-21762-checker
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
100RISK
open ↗GitHub PoC★ 4
CVE-2024-29275.yaml
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code an
48RISK
open ↗VulnCheck XDB
infoleak
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
100RISK
open ↗VulnCheck XDB
initial-access
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326
85RISK
open ↗GitHub PoC
CVE-2023-2825 exploit script
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RISK
open ↗GitHub PoC★ 10
NanoWraith/CVE-2024-29973
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmwar
85RISK
open ↗VulnCheck XDB
local
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proce
98RISK
open ↗GitHub PoC★ 1
WanLiChangChengWanLiChang/CVE-2024-29972
** UNSUPPORTED WHEN ASSIGNED **
The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326
85RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.