Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,094cataloged exploits
41,119CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,277Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,094 exploits
GitHub PoC
NGINX Security Hardening & Vulnerability Remediation Analysis of critical CVEs (CVE-2021-23017, HTTP/2 DoS flaws) in outdated NGINX versions, with actionable steps for mitigation: upgrades, HTTP/2 hardening, and patch automation. Includes Nessus scan validation and proactive monitoring strategies.
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t
35RISK
open ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption
TP-Link VN020 F3v(T) FTP USER Command memory corruption
33RISK
open ↗Exploit-DB
TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS)
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
41RISK
open ↗VulnCheck XDB
initial-access
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗Exploit-DB
ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution
Unauthorized Access
48RISK
open ↗GitHub PoC★ 2
verylazytech/CVE-2025-29306
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗VulnCheck XDB
infoleak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
open ↗VulnCheck XDB
initial-access
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
100RISK
open ↗Exploit-DB
Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Explo
75RISK
open ↗GitHub PoC★ 1
ethicalPap/CVE-2025-29775
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
53RISK
open ↗Exploit-DB
compop.ca 3.5.3 - Arbitrary code Execution
An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and t
48RISK
open ↗Exploit-DB
Hugging Face Transformers MobileViTV2 4.41.1 - Remote Code Execution (RCE)
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability
41RISK
open ↗VulnCheck XDB
infoleak
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated
100RISK
open ↗Exploit-DB
ABB Cylon Aspect 3.08.02 - Cross-Site Request Forgery (CSRF)
Cross Side Request Forgery, CSRF
41RISK
open ↗Exploit-DB
NagVis 1.9.33 - Arbitrary File Read
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagV
48RISK
open ↗Exploit-DB
phpMyFAQ 3.2.10 - Unintended File Download Triggered by Embedded Frames
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
33RISK
open ↗Exploit-DB
Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
41RISK
open ↗Exploit-DB
Car Rental Project 1.0 - Remote Code Execution
PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile ima
23RISK
open ↗Exploit-DB
WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection
WooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection
41RISK
open ↗GitHub PoC
enochgitgamefied/NextJS-CVE-2025-29927
Authorization Bypass in Next.js Middleware
85RISK
open ↗Exploit-DB
Garage Management System 1.0 (categoriesName) - Stored XSS
A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary
33RISK
open ↗Exploit-DB
Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowin
28RISK
open ↗Exploit-DB
FLIR AX8 1.46.16 - Remote Command Injection
All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This
60RISK
open ↗GitHub PoC
Simulates CVE-2025-29927, a critical Next.js vulnerability allowing attackers to bypass middleware authorization by exploiting the internal x-middleware-subrequest HTTP header. Demonstrates unauthorized access to protected routes and provides mitigation strategies.
Authorization Bypass in Next.js Middleware
85RISK
open ↗Metasploit600
Erlang OTP Pre-Auth RCE Scanner and Exploit
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.