Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,094cataloged exploits
41,119CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,277Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,094 exploits
GitHub PoC
PHP CGI Parameter Injection Vulnerability (RCE: Remote Code Execution)
Argument Injection in PHP-CGI
100RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC
FortiGate SSL-VPN CVE-2023-27997 Exploit PoC Script with ROP Chain
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
open ↗GitHub PoC★ 1
This is for educational porpuses only. Please do not use agains unathorized systems.
SQL injection in user.get API
70RISK
open ↗Exploit-DB
Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
75RISK
open ↗Exploit-DB
Inventio Lite 4 - SQL Injection
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action
48RISK
open ↗GitHub PoC★ 1
Erlang/OTP SSH 远程代码执行漏洞
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 142
CVE-2025-32433 https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗Exploit-DB
Langflow 1.3.0 - Remote Code Execution (RCE)
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISK
open ↗GitHub PoC★ 4
PoC - CVE-2025-24071 / CVE-2025-24054, NTMLv2 hash'leri alınabilen bir vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
75RISK
open ↗VulnCheck XDB
initial-access
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
open ↗GitHub PoC
Grand-Moomin/Vuln-Next.js-CVE-2025-29927
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 3
Missing Authentication for Critical Function (CWE-306)-Exploit
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC
Epivalent/CVE-2025-32433-detection
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 16
The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗Exploit-DB
KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
61RISK
open ↗GitHub PoC★ 3
Exploitation module for CVE-2025-32433 (Erlang/OTP)
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗Exploit-DB
Apache Commons Text 1.10.0 - Remote Code Execution
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
open ↗GitHub PoC★ 5
python script to find vulnerable targets of CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 5
ekomsSavior/POC_CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 3
Security research on Erlang/OTP SSH CVE-2025-32433.
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC
NGINX Security Hardening & Vulnerability Remediation Analysis of critical CVEs (CVE-2021-23017, HTTP/2 DoS flaws) in outdated NGINX versions, with actionable steps for mitigation: upgrades, HTTP/2 hardening, and patch automation. Includes Nessus scan validation and proactive monitoring strategies.
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t
35RISK
open ↗GitHub PoC★ 2
verylazytech/CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗Exploit-DB
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.