Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,035cataloged exploits
39,531CVEs with public exploitation
24,695lab-tested
AllReferência 25,557Exploit-DB 24,485GitHub PoC 16,313VulnCheck XDB 9,678Nuclei 4,478Metasploit 3,524✓ verified onlyrecentpopularrisk
3,523 exploits
Metasploit600
MCPJam Inspector Connect API Command Execution
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗Metasploit300
osTicket Arbitrary File Read via PHP Filter Chains in mPDF
osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read
58RISK
open ↗Metasploit600
AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery
AVideo < 20.1 User Information Disclosure via Public API
28RISK
open ↗Metasploit600
AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery
AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
63RISK
open ↗Metasploit300
MongoDB Memory Disclosure (CVE-2025-14847) - Mongobleed
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗Metasploit600
AVideo notify.ffmpeg.json.php Unauthenticated RCE via Salt Discovery
AVideo < 20.1 System Path Disclosure via Public API
28RISK
open ↗Metasploit600
ChurchCRM Unauthenticated RCE via Setup Page
ChurchCRM has unauthenticated RCE in its Install Wizard
43RISK
open ↗Metasploit300
ChurchCRM Database Restore RCE 6.2.0
ChurchCRM vulnerable to RCE with database restore functionality
43RISK
open ↗Metasploit600
HPE OneView unauthenticated RCE
A remote code execution issue exists in HPE OneView.
100RISK
open ↗Metasploit600
Control Web Panel /admin/index.php Unauthenticated RCE
An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. User input passed via the "key" GET parameter to /
56RISK
open ↗Metasploit600
FreeBSD rtsold/rtsol DNSSL Command Injection
Remote code execution via ND6 Router Advertisements
56RISK
open ↗Metasploit600
FreePBX firmware file upload
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
63RISK
open ↗Metasploit600
FreePBX endpoint SQLi to RCE
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
48RISK
open ↗Metasploit300
FreePBX Custom Extension SQL Injection
FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters
48RISK
open ↗Metasploit600
FreePBX endpoint SQLi to RCE
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
63RISK
open ↗Metasploit300
FreePBX Custom Extension SQL Injection
FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
63RISK
open ↗Metasploit600
FreePBX firmware file upload
FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter
48RISK
open ↗Metasploit300
Gladinet CentreStack/Triofox Access Ticket Forge
Gladinet CentreStack and TrioFox Hard Coded AES Keys
98RISK
open ↗Metasploit600
Unauthenticated RCE in React Server Components (React2Shell)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗Metasploit600
WordPress ACF Extended Unauthenticated RCE via prepare_form()
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
75RISK
open ↗Metasploit600
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
Grav ihas Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
36RISK
open ↗Metasploit600
Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
36RISK
open ↗Metasploit600
Eclipse Che machine-exec Unauthenticated RCE
Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333
43RISK
open ↗Metasploit300
GeoServer WMS GetMap XXE Arbitrary File Read
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
98RISK
open ↗Metasploit300
N-able N-Central Authentication Bypass and XXE Scanner
N-central unauthenticated sessionID generation
60RISK
open ↗Metasploit300
N-able N-Central Authentication Bypass and XXE Scanner
N-central Multiple XXE Injection Vulnerabilities
68RISK
open ↗Metasploit600
Fortinet FortiWeb unauthenticated RCE
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vul
90RISK
open ↗Metasploit300
Fortinet FortiWeb create new local admin
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RISK
open ↗Metasploit600
Fortinet FortiWeb unauthenticated RCE
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.