Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,449cataloged exploits

35,552CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecent popular risk

77,401 exploits

GitHub PoC

dcm2406/CVE-2023-46604

CVE-2023-46604CRITICALunder attackransomware16 Dec 2023

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISK

VulnCheck XDB

infoleak

CVE-2023-4966CRITICALunder attackransomware16 Dec 2023

Unauthenticated sensitive information disclosure

100RISK

GitHub PoC★ 2

Simulates CVE-2023-4966 Citrix Bleed overread bug

CVE-2023-4966CRITICALunder attackransomware16 Dec 2023

Unauthenticated sensitive information disclosure

100RISK

GitHub PoC

ZhiQiAnSecFork/cve-2017-16995

CVE-2017-16995—15 Dec 2023

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial

50RISK

VulnCheck XDB

initial-access

CVE-2023-32315HIGHunder attack15 Dec 2023

Openfire administration console authentication bypass

100RISK

VulnCheck XDB

initial-access

CVE-2017-1000486CRITICALunder attack15 Dec 2023

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

100RISK

GitHub PoC

markyu0401/CVE-2021-3560-Polkit-Privilege-Escalation

CVE-2021-3560HIGHunder attack15 Dec 2023

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RISK

GitHub PoC

Remote Code Execution exploit for PrimeFaces 5.x - EL Injection (CVE-2017-1000486)

CVE-2017-1000486CRITICALunder attack15 Dec 2023

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

100RISK

GitHub PoC

ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195

CVE-2016-5195HIGHunder attack15 Dec 2023

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

VulnCheck XDB

initial-access

CVE-2023-50164—15 Dec 2023

Apache Struts: File upload component had a directory traversal vulnerability

45RISK

VulnCheck XDB

local

CVE-2016-5195HIGHunder attack15 Dec 2023

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev

93RISK

GitHub PoC★ 13

A PoC exploit for CVE-2023-32315 - Openfire Authentication Bypass

CVE-2023-32315HIGHunder attack15 Dec 2023

Openfire administration console authentication bypass

100RISK

Metasploit600

MajorDoMo Command Injection

CVE-2023-50917—15 Dec 2023

MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE:

50RISK

GitHub PoC★ 5

Exihibitor Web Ui 1.7.1 RCE, CVE-2019-5029

CVE-2019-5029CRITICAL14 Dec 2023

An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7

60RISK

VulnCheck XDB

initial-access

CVE-2023-49070—14 Dec 2023

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

60RISK

GitHub PoC★ 2

SQL Injection in 3CX CRM Integration

CVE-2023-49954CRITICAL14 Dec 2023

The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search stri

48RISK

GitHub PoC★ 1

imperva/CVE-2023-22524

CVE-2023-22524CRITICAL14 Dec 2023

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An att

53RISK

GitHub PoC★ 25

Atlassian Companion RCE Vulnerability Proof of Concept

CVE-2023-22524CRITICAL14 Dec 2023

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An att

53RISK

GitHub PoC

CVE-2022-4047 poc

CVE-2022-4047CRITICAL14 Dec 2023

Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

48RISK

GitHub PoC

mareks1007/cve-2017-16995

CVE-2017-16995—13 Dec 2023

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial

50RISK

VulnCheck XDB

initial-access

CVE-2023-6553CRITICAL13 Dec 2023

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RISK

VulnCheck XDB

initial-access

CVE-2023-23752MEDIUMunder attack13 Dec 2023

[20230201] - Core - Improper access check in webservice endpoints

100RISK

GitHub PoC

CVE-2023-23752 Joomla Unauthenticated Information Disclosure

CVE-2023-23752MEDIUMunder attack13 Dec 2023

[20230201] - Core - Improper access check in webservice endpoints

100RISK

VulnCheck XDB

local

CVE-2023-32629HIGH13 Dec 2023

Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks

61RISK

GitHub PoC★ 86

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

CVE-2023-6553CRITICAL13 Dec 2023

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RISK

VulnCheck XDB

local

CVE-2023-2640HIGH13 Dec 2023

On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlay

61RISK

GitHub PoC★ 9

CVE-2021-40438 Apache <= 2.4.48 SSRF exploit

CVE-2021-40438CRITICALunder attackransomware12 Dec 2023

mod_proxy SSRF

100RISK

GitHub PoC★ 1

CVE-2023-38831 Proof-of-concept code

CVE-2023-38831HIGHunder attackransomware12 Dec 2023

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISK

GitHub PoC

RCE for Webmin CVE-2019-15107

CVE-2019-15107CRITICALunder attackransomware12 Dec 2023

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

VulnCheck XDB

local

CVE-2020-1472MEDIUMunder attackransomware12 Dec 2023

Netlogon Elevation of Privilege Vulnerability

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.