Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,094cataloged exploits
41,119CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,277Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,094 exploits
GitHub PoC
MacUchegit/Detecting-and-Analyzing-CVE-2024-24919-Exploitation
Information disclosure
100RISK
open ↗GitHub PoC
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
63RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 1
Python exploit for vsftpd 2.3.4 - Backdoor Command Execution
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗VulnCheck XDB
initial-access
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗VulnCheck XDB
initial-access
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗GitHub PoC★ 1
Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗VulnCheck XDB
initial-access
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗GitHub PoC★ 1
imbas007/CVE-2025-25257
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerabi
100RISK
open ↗GitHub PoC
r0otk3r/CVE-2022-1388
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗GitHub PoC★ 1
Proof of Concept for CVE-2025-24813, a Remote Code Execution vulnerability in Apache Tomcat. This PoC exploits unsafe deserialization via crafted session files uploaded through HTTP PUT requests, allowing attackers to execute arbitrary code remotely on vulnerable Tomcat servers.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC
pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck-
WinVerifyTrust Signature Validation Vulnerability
75RISK
open ↗VulnCheck XDB
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗VulnCheck XDB
initial-access
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC
Documentation for CVE-2025-6514. MCP-Remote RCE.
OS command injection in mcp-remote when connecting to untrusted MCP servers
70RISK
open ↗GitHub PoC
r0otk3r/CVE-2024-10915
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISK
open ↗GitHub PoC
Public Disclosure of CVE-2025-52097
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary c
33RISK
open ↗GitHub PoC
just remeber how small mistake in santisize username could give yoy root access to the full machine
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗GitHub PoC★ 6
CVE-2025-24201 WebKit Vulnerability Detector (PoC)
An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in
78RISK
open ↗VulnCheck XDB
initial-access
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
100RISK
open ↗GitHub PoC
p1026/CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗GitHub PoC★ 1
PoC dockerfile image for CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
71RISK
open ↗GitHub PoC
Metasploit module for MailEnable CVE-2022-36934 authentication bypass RCE
An integer overflow in WhatsApp could result in remote code execution in an established video call.
48RISK
open ↗VulnCheck XDB
initial-access
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.