Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,094cataloged exploits
41,119CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,277Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,094 exploits
GitHub PoC
Program python untuk melakukan RCE pada drupal versi 7.56
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC★ 1
PoC of CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
Berisi 2 program C dari exploitDB untuk melakukan privillage eskalation untuk ubuntu 16.04
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
50RISK
open ↗GitHub PoC★ 8
CVE-2024-47533 is a critical authentication bypass vulnerability in Cobbler (versions 3.0.0 to before 3.2.3 and 3.3.7) allowing unauthenticated remote code execution via the XMLRPC interface.
Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
63RISK
open ↗GitHub PoC★ 46
WinRAR 0day CVE-2025-8088 PoC RAR Archive
Path traversal vulnerability in WinRAR
93RISK
open ↗GitHub PoC★ 1
Esse script explora a vulnerabilidade CVE-2025-20124 — uma falha de Java Deserialization no Cisco ISE (Identity Services Engine) que permite Remote Code Execution (RCE).
Cisco Identity Services Engine Java Deserialization Vulnerability
53RISK
open ↗VulnCheck XDB
infoleak
Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to ga
61RISK
open ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC★ 3
CVE-2024-47533: Cobbler Authentication Bypass & Code Execution
Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
63RISK
open ↗VulnCheck XDB
initial-access
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗Exploit-DB
Cisco ISE 3.0 - Authorization Bypass
Cisco Identity Services Engine Insufficient Authorization Bypass Vulnerability
53RISK
open ↗Exploit-DB
Ghost CMS 5.42.1 - Path Traversal
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2
68RISK
open ↗GitHub PoC★ 4
Python exploit for vsftpd 2.3.4 - Backdoor Command Execution
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗Exploit-DB
JetBrains TeamCity 2023.11.4 - Authentication Bypass
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗Exploit-DB
VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS)
VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability
33RISK
open ↗Exploit-DB
Microsoft Windows - Storage QoS Filter Driver Checker
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC★ 1
Este script explora a vulnerabilidade CVE-2025-24813 em versões específicas do Apache Tomcat, permitindo execução remota de código (RCE) através de um vetor de desserialização Java e abuso do método HTTP PUT para gravação arbitrária de arquivos de sessão.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC
Update the old POC of CVE-2025-5777 Citrix NetScaler Memory leak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC
alexander47777/CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗VulnCheck XDB
infoleak
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗Exploit-DB
Microsoft Edge Renderer Process (Mojo IPC) 134.0.6998.177 - Sandbox Escape
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allow
71RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗Exploit-DB
Ghost CMS 5.59.1 - Arbitrary File Read
Arbitrary file read via symlinks in Ghost
45RISK
open ↗GitHub PoC
Bash POC script for RCE vulnerability in Apache 2.4.49
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗Exploit-DB
Microsoft SharePoint Server 2019 (16.0.10383.20020) - Remote Code Execution (RCE)
Microsoft SharePoint Server Remote Code Execution Vulnerability
100RISK
open ↗Exploit-DB
Cisco ISE 3.0 - Remote Code Execution (RCE)
Cisco Identity Services Engine Java Deserialization Vulnerability
53RISK
open ↗Exploit-DB
Belkin F9K1009 F9K1010 2.00.04/2.00.09 - Hard Coded Credentials
Belkin F9K1009/F9K1010 Web Interface hard-coded credentials
48RISK
open ↗GitHub PoC
These PoC python scripts test the Kemp LoadMaster for remote code execution.
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
75RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.