Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,089cataloged exploits
41,118CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,272Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,089 exploits
VulnCheck XDB
client-side
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
55RISK
open ↗Metasploit600
Monsta FTP downloadFile Remote Code Execution
Monsta FTP <= 2.11 Unauthenticated Arbitrary File Upload
85RISK
open ↗GitHub PoC
rockmelodies/django_sqli_target_CVE-2025-64459
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
53RISK
open ↗GitHub PoC★ 5
demo CVE-2019-2215 (Bad Binder) for Android Q
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).
100RISK
open ↗VulnCheck XDB
local
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti
100RISK
open ↗GitHub PoC
CVE-2025-54782
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
75RISK
open ↗VulnCheck XDB
initial-access
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
75RISK
open ↗VulnCheck XDB
client-side
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
75RISK
open ↗VulnCheck XDB
initial-access
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 2
This repository contains research notes and a high-level proof-of-concept (PoC) for CVE-2024-21413, a vulnerability observed in certain mail clients when handling SMB/moniker-style links embedded in messages. The PoC and experiments documented here were performed in a controlled lab environment on systems.
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
63RISK
open ↗GitHub PoC
Billing CTF Machine_CVE-2023-30258_Remote Code Execution
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com
85RISK
open ↗VulnCheck XDB
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
A Dockerized setup for running a vulnerable CrushFTP 10 server instance (CVE-2024-4040).
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RISK
open ↗VulnCheck XDB
initial-access
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
100RISK
open ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗GitHub PoC★ 8
CVE-2025-53690 POC
Sitecore Products ViewState Deserialization Vulnerability
90RISK
open ↗VulnCheck XDB
initial-access
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
100RISK
open ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗VulnCheck XDB
initial-access
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
60RISK
open ↗VulnCheck XDB
initial-access
FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
43RISK
open ↗GitHub PoC★ 10
Breaking down CVE-2025-54253 — an Adobe AEM-Forms exploit path from XXE to full remote code execution and its real-world impact.
Adobe Experience Manager | Incorrect Authorization (CWE-863)
100RISK
open ↗VulnCheck XDB
initial-access
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex
60RISK
open ↗VulnCheck XDB
initial-access
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
100RISK
open ↗GitHub PoC★ 4
CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies.
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.