Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

87,168cataloged exploits
40,553CVEs with public exploitation
24,696lab-tested
AllReferência 26,327Exploit-DB 24,488GitHub PoC 18,080VulnCheck XDB 10,169Nuclei 4,567Metasploit 3,537✓ verified onlyrecentpopularrisk
18,044 exploits
GitHub PoC★ 2
CVE-2021-21985 Checker.
CVE-2021-21985CRITICALunder attackransomware01 Jun 2021
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
100RISK
open ↗
GitHub PoC★ 3
Wordpress XXE injection 구축 자동화 및 PoC
CVE-2021-29447HIGH01 Jun 2021
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
GitHub PoC★ 3
python3 POC for CVE-2019-2729 WebLogic Deserialization Vulnerability and CVE-2017-10271 amongst others
CVE-2017-10271HIGHunder attackransomware31 May 2021
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISK
open ↗
GitHub PoC
rnnsz/CVE-2017-15950
CVE-2017-15950—31 May 2021
Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary co
23RISK
open ↗
GitHub PoC★ 3
python3 POC for CVE-2019-2729 WebLogic Deserialization Vulnerability and CVE-2017-10271 amongst others
CVE-2019-2729CRITICAL31 May 2021
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
GitHub PoC
rnnsz/CVE-2008-4654
CVE-2008-4654—31 May 2021
Stack-based buffer overflow in the parse_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player
50RISK
open ↗
GitHub PoC★ 226
PoC for CVE-2021-28476 a guest-to-host "Hyper-V Remote Code Execution Vulnerability" in vmswitch.sys.
CVE-2021-28476CRITICAL31 May 2021
Windows Hyper-V Remote Code Execution Vulnerability
60RISK
open ↗
GitHub PoC
JBoss CVE-2017-12149 (Insecure Deserialization - RCE) Exploitation Lab.
CVE-2017-12149CRITICALunder attackransomware30 May 2021
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISK
open ↗
GitHub PoC★ 59
arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system
CVE-2021-21551HIGHunder attack30 May 2021
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
100RISK
open ↗
GitHub PoC★ 213
alt3kx/CVE-2021-21985_PoC
CVE-2021-21985CRITICALunder attackransomware29 May 2021
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
100RISK
open ↗
GitHub PoC★ 1
Cacti v1.2.8 Unauthenticated Remote Code Execution
CVE-2020-8813—28 May 2021
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
60RISK
open ↗
GitHub PoC
Proof of Concept for CVE-2020-14295.
CVE-2020-14295—28 May 2021
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead
60RISK
open ↗
GitHub PoC★ 3
My notes for CVE-2004-1561 IceCast exploitation
CVE-2004-1561—28 May 2021
Buffer overflow in Icecast 2.0.1 and earlier allows remote attackers to execute arbitrary code via an HTTP request with
60RISK
open ↗
GitHub PoC★ 1
Script to patch your domain computers about the CVE-2021-21551. Privesc on machines that have the driver dbutil_2_3.sys, installed by some DELL tools (BIOS updater, SupportAssist...)
CVE-2021-21551HIGHunder attack28 May 2021
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
100RISK
open ↗
GitHub PoC
ykg88/OHTS_IE6052-CVE-2020-17087
CVE-2020-17087HIGHunder attack27 May 2021
Windows Kernel Local Elevation of Privilege Vulnerability
71RISK
open ↗
GitHub PoC★ 1
Multiple vulnerabilities in the vSphere Client (HTML5) were privately reported to VMware. Updates and workarounds are available to address these vulnerabilities in affected VMware products.
CVE-2021-21985CRITICALunder attackransomware27 May 2021
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual
100RISK
open ↗
GitHub PoC
Detect vulns liferay CVE-2020-7961 by Nattroc (EOG Team)
CVE-2020-7961CRITICALunder attack27 May 2021
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RISK
open ↗
GitHub PoC
POC-CVE-2020-7961-Token-iterate
CVE-2020-7961CRITICALunder attack26 May 2021
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c
100RISK
open ↗
GitHub PoC
DarkFlameMaster-bit/CVE-2018-8174_EXP
CVE-2018-8174HIGHunder attackransomware25 May 2021
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RISK
open ↗
GitHub PoC
qianniaoge/CVE-2020-14882_Exploit_Gui
CVE-2020-14882CRITICALunder attack25 May 2021
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
GitHub PoC
Exploit CVE-2017-9248 Telerik ReMix from Paul Taylor's script. Exploit Telerik lastest version fixed vuln. ReMix by TinoKa & Shaco JX
CVE-2017-9248CRITICALunder attack24 May 2021
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not
100RISK
open ↗
GitHub PoC
bgsilvait/WIn-CVE-2021-31166
CVE-2021-31166CRITICALunder attack23 May 2021
HTTP Protocol Stack Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC
Qualcomm GPU / ARM Mali GPU
CVE-2021-1905HIGHunder attack23 May 2021
Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon A
71RISK
open ↗
GitHub PoC★ 4
WordPress XXE vulnerability
CVE-2021-29447HIGH23 May 2021
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗
GitHub PoC★ 177
漏洞POC、EXP合集，持续更新。Apache Druid-任意文件读取（CVE-2021-36749）、ConfluenceRCE（CVE-2021-26084）、ZeroShell防火墙RCE（CVE-2019-12725）、ApacheSolr任意文件读取、蓝凌OA任意文件读取、phpStudyRCE、ShowDoc任意文件上传、原创先锋后台未授权、Kyan账号密码泄露、TerraMasterTos任意文件读取、TamronOS-IPTV系统RCE、Wayos防火墙账号密码泄露
CVE-2019-12725—22 May 2021
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web ap
60RISK
open ↗
GitHub PoC★ 8
PoC of how to exploit a RCE vulnerability of the example DAGs in Apache Airflow <1.10.11
CVE-2020-11978HIGHunder attack22 May 2021
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco
100RISK
open ↗
GitHub PoC★ 8
POC for exiftool vuln (CVE-2021-22204).
CVE-2021-22204MEDIUMunder attack21 May 2021
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗
GitHub PoC★ 24
ch3rn0byl/CVE-2021-21551
CVE-2021-21551HIGHunder attack21 May 2021
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
100RISK
open ↗
GitHub PoC
tuo4n8/CVE-2020-2950
CVE-2020-2950CRITICAL21 May 2021
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana
70RISK
open ↗
GitHub PoC
CVE-2019-14287
CVE-2019-14287—20 May 2021
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and se
35RISK
open ↗
← previouspage 506 / 602next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.