Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
18,044 exploits
GitHub PoC★ 17
grafana CVE-2021-43798任意文件读取漏洞POC，采用多插件轮训检测的方法，允许指定单URL和从文件中读取URL
Grafana path traversal
100RISK
open ↗GitHub PoC★ 36
Proof of Concept Exploit for ManageEngine ServiceDesk Plus CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014
100RISK
open ↗GitHub PoC★ 270
A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.
Grafana path traversal
100RISK
open ↗GitHub PoC★ 370
Grafana Unauthorized arbitrary file reading vulnerability
Grafana path traversal
100RISK
open ↗GitHub PoC★ 12
Grafanav8.*版本任意文件读取漏洞批量检测工具：该漏洞目前为0day漏洞，未授权的攻击者利用该漏洞，能够获取服务器敏感文件。
Grafana path traversal
100RISK
open ↗GitHub PoC★ 6
利用grafan CVE-2021-43798任意文件读漏洞，自动探测是否有漏洞、存在的plugin、提取密钥、解密server端db文件，并输出data_sourrce信息。
Grafana path traversal
100RISK
open ↗GitHub PoC
reverse shell execution exploit of CVE 22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗GitHub PoC★ 9
zer0yu/CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗GitHub PoC★ 43
CVE-2021-43798 - Grafana 8.x Path Traversal (Pre-Auth)
Grafana path traversal
100RISK
open ↗GitHub PoC★ 18
CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 8
Microsoft Exchange ProxyLogon PoC (CVE-2021-26855)
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
sinisterghost/https-github.com-iBearcat-CVE-2018-8174_EXP
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RISK
open ↗GitHub PoC
MaximeSchlegel/CVE-2021-32724-Target
check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack
48RISK
open ↗GitHub PoC★ 1
a python3 version of the exploit written for CVE-2014-6287. Useful for completing the "Steel Mountain" room on TryHackMe.com without the use of metasploit.
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC★ 1
CVE-2021-42325 POC
Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.
28RISK
open ↗GitHub PoC
A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC
dearpan/cve-2018-9995
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RISK
open ↗GitHub PoC★ 5
Gex is an iOS 14.7 jailbreak using CVE-2021-30807 IOMFB & CVE-2021-30860 exploit(s)
A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS
76RISK
open ↗GitHub PoC
Strapi Framework, 3.0.0-beta.17.4
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c
35RISK
open ↗GitHub PoC★ 1
NSE script to fingerprint if GitLab is vulnerable to cve-2021-22205-nse
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISK
open ↗GitHub PoC
Detect with python and tracking IP
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC★ 2
Proof of concept for CVE-2020-7247 for educational purposes.
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
100RISK
open ↗GitHub PoC★ 3
A CVE-2021-22205 Gitlab RCE POC written in Golang
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.