Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
77,772 exploits
GitHub PoC★ 2
Dirty Pipe Vulnerability Detection Script - RHSB-2022-002 Dirty Pipe - kernel arbitrary file manipulation - (CVE-2022-0847)
CVE-2022-0847HIGHunder attack06 Apr 2022
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗
GitHub PoC★ 2
The demo code showing the recent Spring4Shell RCE (CVE-2022-22965)
CVE-2022-22965CRITICALunder attack06 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
irgoncalves/irule-cve-2022-22965
CVE-2022-22965CRITICALunder attack06 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22947CRITICALunder attack06 Apr 2022
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
GitHub PoC
Spring4Shell is a critical RCE vulnerability in the Java Spring Framework and is one of three related vulnerabilities published on March 30
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 1
Spring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965.
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
Metasploit600
Dompdf RCE via Malicious Font Caching (CVE-2022-28368)
CVE-2022-28368—05 Apr 2022
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (
60RISK
open ↗
GitHub PoC
Spring Framework RCE Exploit
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 3
Exploit Of Spring4Shell!
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
local
CVE-2022-0185HIGHunder attack05 Apr 2022
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RISK
open ↗
GitHub PoC
CVE-2022-22947 reproduce
CVE-2022-22947CRITICALunder attack05 Apr 2022
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
GitHub PoC★ 40
CVE-2021-22555 exploit rewritten with pipe primitive
CVE-2021-22555HIGHunder attack05 Apr 2022
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RISK
open ↗
GitHub PoC★ 1
CVE-2022-22963 research
CVE-2022-22963CRITICALunder attack05 Apr 2022
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-22555HIGHunder attack05 Apr 2022
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RISK
open ↗
GitHub PoC★ 3
CVE-2020-24186的攻击脚本
CVE-2020-24186CRITICAL05 Apr 2022
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RISK
open ↗
GitHub PoC★ 16
CVE-2022-0185 exploit rewritten with pipe primitive
CVE-2022-0185HIGHunder attack05 Apr 2022
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RISK
open ↗
GitHub PoC
Proof-of-concept exploit for CVE-2016-1827 on OS X Yosemite.
CVE-2016-1827—04 Apr 2022
The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers
23RISK
open ↗
VulnCheck XDB
denial-of-service
CVE-2022-21907CRITICAL04 Apr 2022
HTTP Protocol Stack Remote Code Execution Vulnerability
70RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware04 Apr 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
GitHub PoC★ 128
A REAL DoS exploit for CVE-2022-21907
CVE-2022-21907CRITICAL04 Apr 2022
HTTP Protocol Stack Remote Code Execution Vulnerability
70RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-42013CRITICALunder attackransomware04 Apr 2022
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 1
PowerShell port of CVE-2022-22965 vulnerability check by colincowie.
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 7
CVE-2022-22965 (Spring4Shell) Proof of Concept
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 12
Vulnerability scanner for Spring4Shell (CVE-2022-22965)
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
Intentionally vulnerable Spring app to test CVE-2022-22965
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 3
Another spring4shell (Spring core RCE) POC
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
← previouspage 591 / 2,593next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.