Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,282cataloged exploits
35,464CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,301GitHub PoC 14,132VulnCheck XDB 8,635Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
77,058 exploits
GitHub PoC
corelight/CVE-2021-38647-noimages
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 16
Chequea si tu firewall es vulnerable a CVE-2024-21762 (RCE sin autenticación)
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
100RISK
open ↗Metasploit600
WordPress wp-automatic Plugin SQLi Admin Creation
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC★ 150
out-of-bounds write in Fortinet FortiOS CVE-2024-21762 vulnerability
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
100RISK
open ↗Metasploit600
NorthStar C2 XSS to Agent RCE
Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code
58RISK
open ↗Metasploit300
CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read
ColdFusion | Improper Access Control (CWE-284)
100RISK
open ↗GitHub PoC★ 42
Proof-of-concept exploit for CVE-2024-25153.
Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114
60RISK
open ↗VulnCheck XDB
initial-access
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗GitHub PoC★ 1
CVE-2023-23752 Data Extractor
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF
90RISK
open ↗GitHub PoC★ 3
hienkiet/CVE-2022-21445-for-12.2.1.3.0-Weblogic
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF
90RISK
open ↗GitHub PoC
CSV Injection in Addactis IBNRS 3.10.3.107
CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a craf
48RISK
open ↗GitHub PoC★ 92
Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)
.NET Framework Information Disclosure Vulnerability
100RISK
open ↗VulnCheck XDB
infoleak
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
100RISK
open ↗Exploit-DB
Hide My WP < 6.2.9 - Unauthenticated SQLi
Hide My WP < 6.2.9 - Unauthenticated SQLi
48RISK
open ↗Exploit-DB
Numbas < v7.3 - Remote Code Execution
Numbas editor before 7.3 mishandles editing of themes and extensions.
38RISK
open ↗Exploit-DB
DataCube3 v1.0 - Unrestricted file upload 'RCE'
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An una
53RISK
open ↗GitHub PoC★ 17
Demo showing Claude Opus does not find CVE-2023-0266
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
71RISK
open ↗Exploit-DB
Akaunting < 3.1.3 - RCE
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company loc
60RISK
open ↗Exploit-DB
Ladder v0.0.21 - Server-side request forgery (SSRF)
An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request
41RISK
open ↗Exploit-DB
DataCube3 v1.0 - Unrestricted file upload 'RCE'
F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to
46RISK
open ↗GitHub PoC★ 1
CharonDefalt/CVE-2024-27198-RCE
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗GitHub PoC★ 8
A PoC exploit for CVE-2024-27198 - JetBrains TeamCity Authentication Bypass
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗VulnCheck XDB
initial-access
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗GitHub PoC
Exploit for CVE-2024-22393 Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.
Apache Answer: Pixel Flood Attack by uploading the large pixel file
48RISK
open ↗GitHub PoC
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" i
23RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.