Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
11,299 exploits
client-side
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
client-side
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
info-leak
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
client-side
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
initial-access
Samba: samba: remote code execution in printing subsystem via unescaped job description
68RISK
remote-with-credentials
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISK
initial-access
Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise
75RISK
initial-access
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISK
remote-with-credentials
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
98RISK
initial-access
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
local
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
info-leak
TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L
60RISK
initial-access
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB be
60RISK
initial-access
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISK
initial-access
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
63RISK
initial-access
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISK
info-leak
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISK
denial-of-service
HTTP Protocol Stack Remote Code Execution Vulnerability
70RISK
info-leak
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
info-leak
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
56RISK
remote-with-credentials
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include pa
60RISK
initial-access
Authorization Bypass in Next.js Middleware
85RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.