Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,013cataloged exploits
41,057CVEs with public exploitation
24,696lab-tested
AllReferência 26,648Exploit-DB 24,490GitHub PoC 18,462VulnCheck XDB 11,272Nuclei 4,601Metasploit 3,540✓ verified onlyrecentpopularrisk
89,013 exploits
Exploit-DB
Piwigo 13.6.0 - SQL Injection
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
48RISK
open ↗GitHub PoC
sudlit/CVE-2017-7494
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISK
open ↗VulnCheck XDB
local
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
100RISK
open ↗GitHub PoC
Vulnerable environment for testing CVE-2021-22941 Nuclei template
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacke
90RISK
open ↗GitHub PoC
boro03/CVE-2021-4034
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗Exploit-DB
YOURLS 1.8.2 - Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) in yourls/yourls
28RISK
open ↗Exploit-DB
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
56RISK
open ↗VulnCheck XDB
initial-access
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISK
open ↗GitHub PoC
letsr00t/CVE-2013-2094
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data t
83RISK
open ↗VulnCheck XDB
infoleak
The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with n
23RISK
open ↗VulnCheck XDB
initial-access
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISK
open ↗GitHub PoC★ 9
Reverse engineering research and custom firmware for the Allwinner V3-based SJCAM SJ4000 Air, including firmware parsers, an AVIOCTRL client, security research, and the CVE-2026-52656 proof of concept.
An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an a
48RISK
open ↗GitHub PoC★ 2
Vulnerability: SQL Injection via QuerySet and Q() keyword argument unpacking. CVE ID: CVE-2025-64459 Severity: Critical (CVSS 9.1) Affected Versions: Django 5.1 < 5.1.14, 4.2 < 4.2.26, and 5.2 < 5.2.8. Researcher: Cyberstan (University of Warwick)
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
53RISK
open ↗Metasploit600
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
36RISK
open ↗Metasploit600
Eclipse Che machine-exec Unauthenticated RCE
Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333
43RISK
open ↗Metasploit600
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
36RISK
open ↗GitHub PoC★ 11
Outlook exploitation
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
euxem/Analyse-faille-de-s-curit-CVE-2025-6018-CVE-2025-6019
Pam-config: lpe from unprivileged to allow_active in pam
41RISK
open ↗VulnCheck XDB
initial-access
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experi
60RISK
open ↗VulnCheck XDB
initial-access
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
75RISK
open ↗GitHub PoC
KylVGoi/cve-2019-1663
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗GitHub PoC
sec-dojo-com/CVE-2020-24186
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RISK
open ↗GitHub PoC
CVE-2018-10933 - LibSSH - Authentication Bypass
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISK
open ↗VulnCheck XDB
initial-access
Cisco RV110W, RV130W, and RV215W Routers Management Interface Remote Command Execution Vulnerability
85RISK
open ↗GitHub PoC★ 1
m2hcz/CVE-2025-6440-Poc-Exploit
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISK
open ↗GitHub PoC
xi0onamdev/WinRAR-CVE-2025-8088-Exploitation-Toolkit
Path traversal vulnerability in WinRAR
93RISK
open ↗GitHub PoC
Exploit - CVE-2023-26360
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.