Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits

40,452CVEs with public exploitation

24,696lab-tested

All Referência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC★ 7

Add revert shell

CVE-2021-3129CRITICALunder attackransomware08 Apr 2022

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

100RISK

open ↗

GitHub PoC

POC for the priv esc exploit in PKEXEC [ CVE -2021-4034 ] ( needs fixing, not the best) Converted into go

CVE-2021-4034HIGHunder attackransomware08 Apr 2022

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

open ↗

GitHub PoC

Spring Cloud Config CVE-2019-3799|CVE_2020_5410 漏洞检测

CVE-2019-3799—07 Apr 2022

Directory Traversal with spring-cloud-config-server

60RISK

open ↗

GitHub PoC★ 63

CVE-2022-22965写入冰蝎webshell脚本

CVE-2022-22965CRITICALunder attack07 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC

tmatejicek/CVE-2015-1397

CVE-2015-1397—07 Apr 2022

SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Communit

35RISK

open ↗

GitHub PoC★ 3

CalumHutton/CVE-2022-22965-PoC_Payara

CVE-2022-22965CRITICALunder attack07 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 6

CVE-2022-22965 pocsuite3 POC

CVE-2022-22965CRITICALunder attack07 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 101

Spring Framework RCE (CVE-2022-22965) Nmap (NSE) Checker (Non-Intrusive)

CVE-2022-22965CRITICALunder attack07 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC

Spring4Shell PoC (CVE-2022-22965)

CVE-2022-22965CRITICALunder attack07 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 3

Unquoted Service Path privilege escalation vulnerability in Sherpa Connector Service.

CVE-2022-23909—06 Apr 2022

There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might

23RISK

open ↗

GitHub PoC★ 2

The demo code showing the recent Spring4Shell RCE (CVE-2022-22965)

CVE-2022-22965CRITICALunder attack06 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 1

sh-ubh/CVE-2018-1002105

CVE-2018-1002105CRITICAL06 Apr 2022

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upg

70RISK

open ↗

GitHub PoC★ 2

irgoncalves/irule-cve-2022-22965

CVE-2022-22965CRITICALunder attack06 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 2

Navigate CMS <= 2.9.4 - Server-Side Request Forgery (Authenticated)

CVE-2022-28117—06 Apr 2022

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap

43RISK

open ↗

GitHub PoC★ 2

Dirty Pipe Vulnerability Detection Script - RHSB-2022-002 Dirty Pipe - kernel arbitrary file manipulation - (CVE-2022-0847)

CVE-2022-0847HIGHunder attack06 Apr 2022

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop

100RISK

open ↗

GitHub PoC

vuongnv3389-sec/cve-2021-41773

CVE-2021-41773HIGHunder attackransomware06 Apr 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

open ↗

GitHub PoC★ 12

Spring-Cloud-Spel-RCE

CVE-2022-22947CRITICALunder attack06 Apr 2022

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RISK

open ↗

GitHub PoC★ 1

🚨 Exploit the CVE-2025-49844 Redis Lua interpreter UAF vulnerability to execute arbitrary shellcode and gain persistent backdoor access.

CVE-2025-49844CRITICAL06 Apr 2022

Redis Lua Use-After-Free may lead to remote code execution

85RISK

open ↗

GitHub PoC★ 40

CVE-2021-22555 exploit rewritten with pipe primitive

CVE-2021-22555HIGHunder attack05 Apr 2022

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISK

open ↗

GitHub PoC★ 1

Spring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965.

CVE-2022-22965CRITICALunder attack05 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 3

Exploit Of Spring4Shell!

CVE-2022-22965CRITICALunder attack05 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC

CVE-2022-22947 reproduce

CVE-2022-22947CRITICALunder attack05 Apr 2022

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RISK

open ↗

GitHub PoC

Spring4Shell is a critical RCE vulnerability in the Java Spring Framework and is one of three related vulnerabilities published on March 30

CVE-2022-22965CRITICALunder attack05 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 2

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CVE-2022-22965CRITICALunder attack05 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 1

CVE-2022-22963 research

CVE-2022-22963CRITICALunder attack05 Apr 2022

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po

100RISK

open ↗

GitHub PoC

Spring Framework RCE Exploit

CVE-2022-22965CRITICALunder attack05 Apr 2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

GitHub PoC★ 3

CVE-2020-24186的攻击脚本

CVE-2020-24186CRITICAL05 Apr 2022

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

GitHub PoC★ 16

CVE-2022-0185 exploit rewritten with pipe primitive

CVE-2022-0185HIGHunder attack05 Apr 2022

A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio

76RISK

open ↗

GitHub PoC

Proof-of-concept exploit for CVE-2016-1827 on OS X Yosemite.

CVE-2016-1827—04 Apr 2022

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers

23RISK

open ↗

GitHub PoC★ 10

CVE-2021-41773 | CVE-2021-42013 Exploit Tool (Apache/2.4.49-2.4.50)

CVE-2021-41773HIGHunder attackransomware04 Apr 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.