Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,020 exploits

GitHub PoC

Repository to exploit CVE-2023-46604 reported for ActiveMQ

CVE-2023-46604CRITICALunder attackransomware30 Dec 2023

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISK

GitHub PoC★ 1

DASICS-ICT/DASICS-CVE-2021-3156

CVE-2021-3156HIGHunder attack30 Dec 2023

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

GitHub PoC

DARKSTUFF-LAB/-CVE-2022-26134

CVE-2022-26134CRITICALunder attackransomware29 Dec 2023

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

GitHub PoC

Joomla Information disclosure exploit code written in C++.

CVE-2023-23752MEDIUMunder attack29 Dec 2023

[20230201] - Core - Improper access check in webservice endpoints

100RISK

GitHub PoC

rapid-reset-check is a small Go CLI for quickly inventorying HTTPS endpoints that expose HTTP/2 and therefore need a CVE-2023-44487 mitigation review

CVE-2023-44487HIGHunder attack29 Dec 2023

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many

93RISK

GitHub PoC★ 1

CVE-2022-22963-poc

CVE-2022-22963CRITICALunder attack28 Dec 2023

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po

100RISK

GitHub PoC★ 3

CVE-2006-2842 is a powerful scanner for bug bounty hunters and penetration testers to discover vulnerabilities in their web applications.

CVE-2006-2842—28 Dec 2023

PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals i

50RISK

GitHub PoC★ 5

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2023-36025HIGHunder attack28 Dec 2023

Windows SmartScreen Security Feature Bypass Vulnerability

93RISK

GitHub PoC

Custom POC of CVE-2021-22986 by Al1ex@Heptagram

CVE-2021-22986CRITICALunder attackransomware28 Dec 2023

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.

100RISK

GitHub PoC

solomon12354/LockingGirl-----CVE-2022-0847-Dirty_Pipe_virus

CVE-2022-0847HIGHunder attack28 Dec 2023

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

GitHub PoC★ 13

Exploit for Microsoft SharePoint 2019

CVE-2023-24955HIGHunder attackransomware28 Dec 2023

Microsoft SharePoint Server Remote Code Execution Vulnerability

100RISK

GitHub PoC

vinnie1717/CVE-2023-48974

CVE-2023-48974CRITICAL28 Dec 2023

Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges

48RISK

GitHub PoC

substing/CVE-2019-11447_reverse_shell_upload

CVE-2019-11447—28 Dec 2023

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

35RISK

GitHub PoC

ducnorth2712/CVE-2023-23397

CVE-2023-23397CRITICALunder attack28 Dec 2023

Microsoft Outlook Elevation of Privilege Vulnerability

100RISK

GitHub PoC

POC +report note

CVE-2018-17552—27 Dec 2023

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigat

60RISK

GitHub PoC

jee web project with sanitised log4shell (CVE-2021-44228) vulnerability

CVE-2021-44228CRITICALunder attackransomware27 Dec 2023

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 4

motikan2010/CVE-2023-6553-PoC

CVE-2023-6553CRITICAL27 Dec 2023

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RISK

GitHub PoC

DDayLuong/CVE-2021-3156

CVE-2021-3156HIGHunder attack27 Dec 2023

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

GitHub PoC

DDayLuong/CVE-2019-18634

CVE-2019-18634—27 Dec 2023

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RISK

GitHub PoC★ 11

Exploit for CVE-2023-41892

CVE-2023-41892CRITICAL26 Dec 2023

Craft CMS Remote Code Execution vulnerability

85RISK

GitHub PoC★ 1

MkJos/CVE-2023-33246_RocketMQ_RCE_EXP

CVE-2023-33246CRITICALunder attack26 Dec 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

GitHub PoC★ 1

This is a exploit of CVE-2021-32305 a web vulnerability to command injection on search.php path, this exploit allows execute commands.

CVE-2021-32305—26 Dec 2023

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search paramet

60RISK

GitHub PoC★ 5

Exploit for Arbitrary File Read for CVE-2023-26360 - Adobe Coldfusion

CVE-2023-26360HIGHunder attack26 Dec 2023

Adobe ColdFusion Improper Access Control Arbitrary code execution

100RISK

GitHub PoC★ 2

Exploit Development using python for CVE-2023-38831 (POC)

CVE-2023-38831HIGHunder attackransomware26 Dec 2023

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISK

GitHub PoC

kimstars/POC-CVE-2022-28117

CVE-2022-28117—26 Dec 2023

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap

43RISK

GitHub PoC★ 9

🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓

CVE-2021-4045CRITICAL26 Dec 2023

TP-LINK Tapo C200 remote code execution vulnerability

70RISK

GitHub PoC

tannlh/CVE-2018-20250

CVE-2018-20250HIGHunder attackransomware26 Dec 2023

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISK

GitHub PoC★ 1

TP-Link Archer AX21 - Unauthenticated Command Injection [Loader]

CVE-2023-1389HIGHunder attack25 Dec 2023

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i

100RISK

GitHub PoC★ 1

Welcome to the Metasploit Exploits Repository, your go-to resource for a comprehensive collection of cutting-edge exploits designed for penetration testing and ethical hacking. Developed and maintained by Mohamed Mounir Boudjema, this repository is crafted with a deep understanding of the evolving landscape of cybersecurity.

CVE-2023-6710MEDIUM25 Dec 2023

Mod_cluster/mod_proxy_cluster: stored cross site scripting

33RISK

GitHub PoC★ 13

dust-life/CVE-2019-18935-memShell

CVE-2019-18935CRITICALunder attackransomware25 Dec 2023

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.