Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
77,724 exploits
Exploit-DB
Wavlink WN533A8 - Password Disclosure
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via vie
43RISK
open ↗Exploit-DB
WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
Duplicator < 1.4.7 - Unauthenticated Backup Download
43RISK
open ↗Exploit-DB
Easy Chat Server 3.1 - Remote Stack Buffer Overflow (SEH)
chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username
60RISK
open ↗GitHub PoC★ 1
Script en python sobre la vulnerabilidad CVE-2021-4034
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC★ 3
COMPILED
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC★ 4
r4x0r1337/-CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗VulnCheck XDB
initial-access
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
100RISK
open ↗VulnCheck XDB
initial-access
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
60RISK
open ↗Exploit-DB
Wavlink WN533A8 - Cross-Site Scripting (XSS)
Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via th
38RISK
open ↗VulnCheck XDB
initial-access
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗GitHub PoC
PoC exploit for CVE-2017-1000251 (modified)
The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and includ
28RISK
open ↗GitHub PoC★ 2
Script to exploit CVE-2018-1042 in order to do internal port scans.
Moodle 3.x has Server Side Request Forgery in the filepicker.
28RISK
open ↗VulnCheck XDB
initial-access
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in th
100RISK
open ↗GitHub PoC★ 25
「💥」CVE-2022-33891 - Apache Spark Command Injection
Apache Spark shell command injection vulnerability via Spark UI
100RISK
open ↗GitHub PoC★ 15
Confluence Hardcoded Password POC
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in th
100RISK
open ↗VulnCheck XDB
initial-access
Apache Spark shell command injection vulnerability via Spark UI
100RISK
open ↗VulnCheck XDB
initial-access
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RISK
open ↗GitHub PoC
xpgdgit/CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
100RISK
open ↗GitHub PoC★ 78
wo ee cve-2022-2185 gitlab authenticated rce
A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to
85RISK
open ↗Exploit-DB
Dingtian-DT-R002 3.1.276A - Authentication Bypass
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post reques
38RISK
open ↗Exploit-DB
rpc.py 0.6.0 - Remote Code Execution (RCE)
rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header i
35RISK
open ↗GitHub PoC
Reports on post-exploitation on honeypot exploiting vulnerable wu-ftpd (CVE-2001-0550)
wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which i
45RISK
open ↗GitHub PoC★ 1
libSSH-Authentication-Bypass
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISK
open ↗GitHub PoC★ 3
Atlassian Confluence Server and Data Center: CVE-2022-26138
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in th
100RISK
open ↗GitHub PoC★ 408
警惕 一种针对红队的新型溯源手段!
Remote Procedure Call Runtime Remote Code Execution Vulnerability
70RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.