Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,094cataloged exploits
41,119CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,277Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,094 exploits
VulnCheck XDB
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗Exploit-DB
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗GitHub PoC
Research on Next.js middleware vulnerability (CVE-2025-29927) allowing authorization bypass and potential exploits.
Authorization Bypass in Next.js Middleware
85RISK
open ↗VulnCheck XDB
initial-access
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗VulnCheck XDB
denial-of-service
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗GitHub PoC
pickovven/vulnerable-nextjs-14-CVE-2025-29927
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 48
Proof of Concept for CVE-2025-31161 / CVE-2025-2825
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISK
open ↗GitHub PoC★ 1
GadaLuBau1337/CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗VulnCheck XDB
denial-of-service
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗Exploit-DB
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and re
23RISK
open ↗GitHub PoC★ 2
Prevent CVE-2025-22457 and other security problems with Juniper/Ivanti Secure Connect SSL VPN
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗GitHub PoC
Project Repository for Exploitation, Detection and Mitigation of Folina Vulnerability (CVE-2022-30190)
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗Exploit-DB
InfluxDB OSS 2.7.11 - Operator Token Privilege Escalation
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows aut
48RISK
open ↗Exploit-DB
GeoVision GV-ASManager 6.1.0.0 - Information Disclosure
Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which
46RISK
open ↗GitHub PoC★ 2
sandsoncosta/CVE-2025-26633
Microsoft Management Console Security Feature Bypass Vulnerability
83RISK
open ↗VulnCheck XDB
initial-access
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unle
100RISK
open ↗Exploit-DB
Sony XAV-AX5500 1.13 - Firmware Update Validation Remote Code Execution (RCE)
Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability
33RISK
open ↗Exploit-DB
Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE)
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios
100RISK
open ↗GitHub PoC
CVE-2025-29927 ~ a poc of the next.js middleware authentication bypass
Authorization Bypass in Next.js Middleware
85RISK
open ↗Exploit-DB
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
45RISK
open ↗GitHub PoC
DFG register allocation bug in JavaScriptCore
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18
71RISK
open ↗VulnCheck XDB
client-side
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18
71RISK
open ↗GitHub PoC
Demonstration of CVE-2023-23397 Outlook Privellege Escalation vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.