Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC★ 106

Full Chain Analysis of CVE-2022-4262, a non-trivial feedback slot type confusion in V8.

CVE-2022-4262HIGHunder attack13 Jul 2023

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corru

76RISK

open ↗

GitHub PoC

Proof of concept for LabVIEW Web Server HTTP Get Newline DoS vulnerability

CVE-2002-0748—13 Jul 2023

LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET reques

28RISK

open ↗

GitHub PoC★ 1

Recent Campaign abusing CVE-2023-36884

CVE-2023-36884HIGHunder attackransomware13 Jul 2023

Windows Search Remote Code Execution Vulnerability

93RISK

open ↗

GitHub PoC★ 2

This is a Python3 script that demonstrates an exploit for a Blind SQL Injection vulnerability in WebERP version 4.15.

CVE-2019-13292—13 Jul 2023

A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is d

23RISK

open ↗

GitHub PoC★ 13

This project is a Python script that exploits the CVE-2023-24489 vulnerability in ShareFile. It allows remote command execution on the target server. The script supports both Windows and Linux (On testing) platforms, and it can be used to exploit individual targets or perform mass checking on a list of URLs.

CVE-2023-24489CRITICALunder attack12 Jul 2023

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, coul

100RISK

open ↗

GitHub PoC★ 26

The remediation script should set the reg entries described in https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884 . The detection script checks if they exist. Provided AS-IS without any warrenty.

CVE-2023-36884HIGHunder attackransomware12 Jul 2023

Windows Search Remote Code Execution Vulnerability

93RISK

open ↗

GitHub PoC

F5-BIG-IP Remote Code Execution Vulnerability CVE-2022-1388: A Case Study

CVE-2022-1388CRITICALunder attackransomware12 Jul 2023

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

GitHub PoC★ 1

asepsaepdin/CVE-2021-1732

CVE-2021-1732HIGHunder attackransomware11 Jul 2023

Windows Win32k Elevation of Privilege Vulnerability

100RISK

open ↗

GitHub PoC★ 2

CVE-2023-27372-SPIP-CMS-Bypass

CVE-2023-27372CRITICAL11 Jul 2023

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T

85RISK

open ↗

GitHub PoC

CVE-2023-3460

CVE-2023-3460—11 Jul 2023

Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

60RISK

open ↗

GitHub PoC★ 7

Exploit and scanner for CVE-2023-3460

CVE-2023-3460—11 Jul 2023

Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

60RISK

open ↗

GitHub PoC★ 1

Python script that generates pfs payloads to exploit CVE-2022-4510

CVE-2022-4510HIGH11 Jul 2023

Path Traversal in binwalk

46RISK

open ↗

GitHub PoC★ 2

Search vulnerable FortiOS devices via Shodan (CVE-2023-27997)

CVE-2023-27997CRITICALunder attackransomware11 Jul 2023

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi

100RISK

open ↗

GitHub PoC

asepsaepdin/CVE-2021-3560

CVE-2021-3560HIGHunder attack10 Jul 2023

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RISK

open ↗

GitHub PoC★ 6

asepsaepdin/CVE-2023-22809

CVE-2023-22809HIGH10 Jul 2023

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen

68RISK

open ↗

GitHub PoC

asepsaepdin/CVE-2021-4034

CVE-2021-4034HIGHunder attackransomware10 Jul 2023

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

open ↗

GitHub PoC

bthnrml/guncel-cve-2019-9053.py

CVE-2019-9053—09 Jul 2023

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISK

open ↗

GitHub PoC★ 1

Using CVE-2022-0847, "Dirty Pipe Exploit", to pop a reverse bash shell for arbitrary code execution on a foreign machine.

CVE-2022-0847HIGHunder attack09 Jul 2023

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

open ↗

GitHub PoC★ 10

POC for CVE-2023-34362 affecting MOVEit Transfer

CVE-2023-34362CRITICALunder attackransomware09 Jul 2023

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RISK

open ↗

GitHub PoC★ 4

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder.

CVE-2023-32235HIGH09 Jul 2023

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2

68RISK

open ↗

GitHub PoC

Mass CVE-2023-3460.

CVE-2023-3460—09 Jul 2023

Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

60RISK

open ↗

GitHub PoC

Icinga Web 2 - Authenticated Remote Code Execution <2.8.6, <2.9.6, <2.10

CVE-2022-24715HIGH08 Jul 2023

Arbitrary code execution for authenticated users in Icinga Web 2

46RISK

open ↗

GitHub PoC

An issue in MiniTool Partition Wizard ShadowMaker v.12.7 allows an attacker to execute arbitrary code and gain privileges via the SchedulerService.exe component.

CVE-2023-36165—08 Jul 2023

20RISK

open ↗

GitHub PoC★ 2

Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL

CVE-2023-36163—08 Jul 2023

Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code

23RISK

open ↗

GitHub PoC

An issue in MiniTool Partition Wizard ShadowMaker v.12.7 allows an attacker to execute arbitrary code via the MTAgentService component

CVE-2023-36164—08 Jul 2023

20RISK

open ↗

GitHub PoC

rizqimaulanaa/CVE-2023-3460

CVE-2023-3460—07 Jul 2023

Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

60RISK

open ↗

GitHub PoC

pitufo1721/CVE-2025-55182-GodzillaMemoryShell

CVE-2025-55182CRITICALunder attackransomware07 Jul 2023

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC

Achat 0.150 beta7 - Remote Buffer Overflow Rewrite for python3 for the PNPT course.

CVE-2015-1578—07 Jul 2023

Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web s

23RISK

open ↗

GitHub PoC

LoaiEsam37/CVE-2023-2982

CVE-2023-2982CRITICAL07 Jul 2023

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

75RISK

open ↗

GitHub PoC★ 5

CVE-2023-32315-Openfire-Bypass

CVE-2023-32315HIGHunder attack07 Jul 2023

Openfire administration console authentication bypass

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.