Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,112cataloged exploits

40,548CVEs with public exploitation

24,696lab-tested

All Referência 26,327Exploit-DB 24,488GitHub PoC 18,072VulnCheck XDB 10,121Nuclei 4,567Metasploit 3,537✓ verified onlyrecent popular risk

18,044 exploits

GitHub PoC★ 26

CVE-2022-21907: detection, protection, exploitation and demonstration. Exploitation: Powershell, Python, Ruby, NMAP and Metasploit. Detection and protection: Powershell. Demonstration: Youtube.

CVE-2022-21907CRITICAL15 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC★ 1

cf8-upload.py | CVE-2009-2265

CVE-2009-2265—14 Jan 2022

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable fil

60RISK

GitHub PoC★ 1

Demonstration of the WP Visitor Statistics plugin exploit

CVE-2021-24750—14 Jan 2022

WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection

50RISK

GitHub PoC

This Pwsh script run AppScan Standard scans against a list of web sites (URLs.txt) checking for Log4J (CVE-2021-44228) vulnerability

CVE-2021-44228CRITICALunder attackransomware14 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 9

POC of CVE-2021-26084, which is Atlassian Confluence Server OGNL(Object-Graph Navigation Language) Pre-Auth RCE Injection Vulneralibity.

CVE-2021-26084CRITICALunder attackransomware13 Jan 2022

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

GitHub PoC★ 1

This work includes testing and improvement tools for CVE-2021-44228(log4j).

CVE-2021-44228CRITICALunder attackransomware13 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

solitarysp/Log4j-CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware13 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

Script to create a log4j (CVE-2021-44228) exploit with support for different methods of getting a reverse shell

CVE-2021-44228CRITICALunder attackransomware13 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

Fix: CVE-2021-44228 4LOGJ

CVE-2021-44228CRITICALunder attackransomware13 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

School project - Please use other repos for actual testing

CVE-2021-41773HIGHunder attackransomware12 Jan 2022

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

GitHub PoC

Démo du fonctionnement de log4shell (CVE-2021-44228)

CVE-2021-44228CRITICALunder attackransomware12 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

CVE-2020-15261 test

CVE-2020-15261HIGH12 Jan 2022

Unquoted service path vulnerability on Veyon

46RISK

GitHub PoC★ 5

cve-2022-21907

CVE-2022-21907CRITICAL11 Jan 2022

HTTP Protocol Stack Remote Code Execution Vulnerability

70RISK

GitHub PoC

Veids/CVE-2020-3452_auto

CVE-2020-3452HIGHunder attack10 Jan 2022

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

100RISK

GitHub PoC★ 5

lsw29475/CVE-2020-9715

CVE-2020-9715HIGHunder attack10 Jan 2022

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.3

83RISK

GitHub PoC

Scan and patch tool for CVE-2021-44228 and related log4j concerns.

CVE-2021-44228CRITICALunder attackransomware10 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

Created after the disclosure of CVE-2021-44228. Bash script that detects Log4j occurrences in your projects and systems, allowing you to get insight on versions used. Unpacks JARs and analyses their Manifest files.

CVE-2021-44228CRITICALunder attackransomware09 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 5

This Log4j RCE exploit originated from https://github.com/tangxiaofeng7/CVE-2021-44228-Apache-Log4j-Rce

CVE-2021-44228CRITICALunder attackransomware09 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 3

CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware08 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

A vulnerable Java based REST API for demonstrating CVE-2021-44228 (log4shell).

CVE-2021-44228CRITICALunder attackransomware08 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 2

h3x0v3rl0rd/CVE-2018-16763

CVE-2018-16763—08 Jan 2022

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca

60RISK

GitHub PoC★ 5

rodpwn/CVE-2021-43798-mass_scanner

CVE-2021-43798HIGHunder attack08 Jan 2022

Grafana path traversal

100RISK

GitHub PoC★ 2

Log4jshell - CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware07 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

CVE-2021-42013-exp

CVE-2021-42013CRITICALunder attackransomware07 Jan 2022

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

100RISK

GitHub PoC

Grafana8.x 任意文件读取

CVE-2021-43798HIGHunder attack06 Jan 2022

Grafana path traversal

100RISK

GitHub PoC

运用golang写的grafana批量验证脚本，内置48个验证

CVE-2021-43798HIGHunder attack06 Jan 2022

Grafana path traversal

100RISK

GitHub PoC

alexpena5635/CVE-2021-44228_scanner-main-Modified-

CVE-2021-44228CRITICALunder attackransomware05 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

A vulnerable web app for log4j2 RCE(CVE-2021-44228) exploit test.

CVE-2021-44228CRITICALunder attackransomware05 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 119

Exploiting CVE-2021-44228 in VMWare Horizon for remote code execution and more.

CVE-2021-44228CRITICALunder attackransomware05 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 3

A simple program to demonstrate how Log4j vulnerability can be exploited ( CVE-2021-44228 )

CVE-2021-44228CRITICALunder attackransomware05 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.