Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,094cataloged exploits
41,119CVEs with public exploitation
24,696lab-tested
AllReferência 26,689Exploit-DB 24,490GitHub PoC 18,485VulnCheck XDB 11,277Nuclei 4,613Metasploit 3,540✓ verified onlyrecentpopularrisk
89,094 exploits
Exploit-DB
Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to ex
33RISK
open ↗GitHub PoC
User Registration & Membership <= 4.1.2 - Authentication Bypass
User Registration & Membership < 4.1.3 - Authentication Bypass
41RISK
open ↗VulnCheck XDB
initial-access
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
open ↗GitHub PoC
A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts.
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 1
mass scan for CVE-2025-30208
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC★ 2
Detection of malicious VHD files for CVE-2025-24985
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
71RISK
open ↗GitHub PoC★ 9
WordPress Front End Users Plugin <= 3.2.32 is vulnerable to Arbitrary File Upload
Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload
53RISK
open ↗Exploit-DB
SAP NetWeaver - 7.53 - HTTP Request Smuggling
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and
100RISK
open ↗GitHub PoC
corsisechero/CVE-2019-9193byVulHub
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISK
open ↗VulnCheck XDB
client-side
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
90RISK
open ↗VulnCheck XDB
infoleak
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
100RISK
open ↗VulnCheck XDB
infoleak
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗GitHub PoC
Authorization Bypass in Next.js Middleware
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 1
Next.js Middleware Bypass Vulnerability
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 5
SAPGateBreaker is a PoC exploit for CVE-2022-22536, a critical HTTP Request Smuggling vulnerability in SAP NetWeaver. It demonstrates how to bypass ACLs by desynchronizing request parsing between ICM and backend services using crafted Content-Length-based payloads.
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and
100RISK
open ↗GitHub PoC
DeividasTerechovas/SOC227-Microsoft-SharePoint-Server-Elevation-of-Privilege-Possible-CVE-2023-29357-Exploitation
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗VulnCheck XDB
infoleak
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and
100RISK
open ↗VulnCheck XDB
initial-access
Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
78RISK
open ↗GitHub PoC
Next.js CVE-2025-29927 güvenlik açığı hakkında
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
congdong007/CVE-2024-50623-poc
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗GitHub PoC★ 6
Vite 任意文件读取漏洞POC
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
100RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC
Unauthenticated SQL injection exploit for CVE-2019-9053 in CMS Made Simple <= 2.2.9. Extracts admin creds with time-based SQLi.
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗GitHub PoC
backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 해킹
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_ac
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.