Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
76,649 exploits
GitHub PoC★ 10
This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js (pdfjs-dist) library reported in CVE-2024-4367
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
WinRAR漏洞测试复现。详参：https://flowus.cn/share/a3b35db0-ab5e-4abc-b8d3-5ff284e82e7b
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
open ↗VulnCheck XDB
infoleak
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISK
open ↗VulnCheck XDB
local
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISK
open ↗GitHub PoC★ 19
PoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution
An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in
48RISK
open ↗GitHub PoC
The TL;DR for the learnings of Windows Vulnerability CVE-2023-28252
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISK
open ↗GitHub PoC
SolarWinds Serv-U Directory Traversal Vulnerability (CVE-2024-28995) POC
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC
Shadow-Spinner/CVE-2012-2982_python
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid
50RISK
open ↗GitHub PoC
snapcreek_duplicator file read vulnerability https://www.cvedetails.com/cve/CVE-2020-11738/
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traver
100RISK
open ↗VulnCheck XDB
infoleak
The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traver
100RISK
open ↗GitHub PoC★ 1
huseyinstif/CVE-2024-28995-Nuclei-Template
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC★ 14
CVE-2024-28995 POC Vulnerability Scanner
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC★ 2
ggfzx/CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC
cve-2024/CVE-2024-4898-Poc
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
63RISK
open ↗GitHub PoC
Rejetto HFS (HTTP File Server) is a simple web file server that facilitates file sharing over a network or the internet.
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 2
Exploit for CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC
cve-2024/CVE-2024-27956-RCE
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC★ 1
qinzhu111/uWSGI-CVE-2018-7490-POC
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversa
50RISK
open ↗VulnCheck XDB
initial-access
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.