Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,813cataloged exploits
35,788CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,455Referência 22,549GitHub PoC 14,290VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
77,724 exploits
Exploit-DB
Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attack
23RISK
open ↗GitHub PoC
WebLogic CNVD-C-2019_48814 CVE-2017-10271 Scan By 7kbstorm
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supporte
100RISK
open ↗Exploit-DB
Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF)
Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending
23RISK
open ↗Exploit-DB
Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
Code Injection in Sourcegraph
78RISK
open ↗GitHub PoC★ 1
I wrote a blog post about Apache CouchDB CVE-2022-24706 RCE Exploits
Remote Code Execution Vulnerability in Packaging
100RISK
open ↗VulnCheck XDB
client-side
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS
76RISK
open ↗Exploit-DB
ChurchCRM 4.4.5 - SQLi
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
23RISK
open ↗Exploit-DB
Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)
Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
35RISK
open ↗GitHub PoC
ernestak/Sigma-Rule-for-CVE-2022-30190
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗Exploit-DB
Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators t
35RISK
open ↗Exploit-DB
Virtua Software Cobranca 12S - SQLi
Virtua Cobranca before 12R allows SQL Injection on the login page.
50RISK
open ↗GitHub PoC★ 1
CVE-2022-22620: Use-after-free in Safari
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS
76RISK
open ↗Metasploit600
Zyxel Firewall SUID Binary Privilege Escalation
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 t
36RISK
open ↗GitHub PoC
ernestak/CVE-2022-30190
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 2
An Unofficial Patch Follina CVE-2022-30190 (patch) by micrisoft Guidelines.
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 4
CVE-2022-26134 - Pre-Auth Remote Code Execution via OGNL Injection
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗VulnCheck XDB
initial-access
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗GitHub PoC★ 1
CVE-2022-30525 POC
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗VulnCheck XDB
initial-access
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗VulnCheck XDB
denial-of-service
Remote Procedure Call Runtime Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC★ 106
PoC for CVE-2022-26809, analisys and considerations are shown in the github.io.
Remote Procedure Call Runtime Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
These are the source codes of the Python scripts to apply the temporary protection against the CVE-2022-30190 vulnerability (Follina)
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 2
seymanurmutlu/CVE-2022-24086-CVE-2022-24087
Adobe Commerce checkout improper input validation leads to remote code execution
100RISK
open ↗GitHub PoC
ahmetfurkans/CVE-2022-22718
Windows Print Spooler Elevation of Privilege Vulnerability
76RISK
open ↗GitHub PoC
Log4Shell CVE-2021-44228 Demo
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 1
A OS Command Injection Vulnerability in the CGI Program of Zyxel
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Pat
100RISK
open ↗GitHub PoC
These are two Python scripts compiled to easily and quickly apply temporary protection against the CVE-2022-30190 vulnerability (Follina)
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.