Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
77,020 exploits
VulnCheck XDB
initial-access
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
63RISK
open ↗GitHub PoC
cve-2024/CVE-2024-27956-RCE
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC
cve-2024/CVE-2024-4898-Poc
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
63RISK
open ↗GitHub PoC★ 2
ggfzx/CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC★ 2
Exploit for CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC★ 14
CVE-2024-28995 POC Vulnerability Scanner
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC
TikiWiki CMS Groupware v8.3 - Open Redirect
tiki-featured_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frame
43RISK
open ↗GitHub PoC★ 1
huseyinstif/CVE-2024-28995-Nuclei-Template
SolarWinds Serv-U L Directory Transversal Vulnerability
100RISK
open ↗GitHub PoC
cve-2024/CVE-2024-4295-Poc
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
68RISK
open ↗GitHub PoC
Rejetto HFS (HTTP File Server) is a simple web file server that facilitates file sharing over a network or the internet.
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗VulnCheck XDB
infoleak
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
68RISK
open ↗GitHub PoC★ 1
qinzhu111/uWSGI-CVE-2018-7490-POC
uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversa
50RISK
open ↗GitHub PoC
Valve Press - CVE-2024-27956-RCE - SQL Injection
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC★ 4
Fixed and minimalist PoC of the CVE-2024-4577
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051)
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
48RISK
open ↗VulnCheck XDB
initial-access
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC★ 11
vanboomqi/CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 12
PDF.js是由Mozilla维护的基于JavaScript的PDF查看器。此漏洞允许攻击者在打开恶意 PDF 文件后立即执行任意 JavaScript 代码。这会影响所有 Firefox 用户 （<126），因为 Firefox 使用 PDF.js 来显示 PDF 文件，但也严重影响了许多基于 Web 和 Electron 的应用程序，这些应用程序（间接）使用 PDF.js 进行预览功能。
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC★ 20
PoC for the Veeam Recovery Orchestrator Authentication CVE-2024-29855
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
53RISK
open ↗GitHub PoC
Fix for CVE-2018-15473
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.