Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,089cataloged exploits
41,118CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,272Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,089 exploits
GitHub PoC
Detection for CVE-2025-34299
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
85RISK
open ↗GitHub PoC★ 5
Wh04m1001/CVE-2025-60710
Host Process for Windows Tasks Elevation of Privilege Vulnerability
71RISK
open ↗GitHub PoC
harekrishnarai/CVE-2024-23897-test-windows
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗GitHub PoC★ 2
AstrBot老版本RCE
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key us
41RISK
open ↗GitHub PoC
Ghstxz/CVE-2025-32463
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC
Exploit and test stand for CVE-2025-2945
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
75RISK
open ↗GitHub PoC★ 1
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
60RISK
open ↗VulnCheck XDB
initial-access
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
100RISK
open ↗GitHub PoC★ 1
check if vulnerable python-django version to CVE-2025-64459 bug
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
53RISK
open ↗GitHub PoC★ 12
CVE-2025-6554
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write v
76RISK
open ↗GitHub PoC
A proof of concept for CVE-2025-24054/CVE-2025-24071
NTLM Hash Disclosure Spoofing Vulnerability
75RISK
open ↗GitHub PoC
l1nuxkid/CVE-2025-32433-exploit
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗VulnCheck XDB
client-side
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitra
83RISK
open ↗GitHub PoC★ 9
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
85RISK
open ↗Metasploit600
FreePBX filestore authenticated command injection
FreePBX Administration GUI is Vulnerable to Authenticated Command Injection
100RISK
open ↗GitHub PoC
letsr00t/-CVE-2019-18634-sudo-pwfeedback
In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the
28RISK
open ↗VulnCheck XDB
infoleak
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
85RISK
open ↗VulnCheck XDB
client-side
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗GitHub PoC★ 10
Firefox/Tor Browser 0day exploit analysis (CVE-2024-9680) A UAF in animation timelines leading to RCE. Patched.
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timeli
83RISK
open ↗VulnCheck XDB
client-side
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
55RISK
open ↗VulnCheck XDB
initial-access
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic
100RISK
open ↗GitHub PoC
Tomcat - PUT Method
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisati
100RISK
open ↗GitHub PoC★ 1
Emergency Chrome update information and tools for CVE-2023-7024 and other critical vulnerabilities
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit
71RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.