Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525VulnCheck XDB 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
GitHub PoC★ 12
PDF.js是由Mozilla维护的基于JavaScript的PDF查看器。此漏洞允许攻击者在打开恶意 PDF 文件后立即执行任意 JavaScript 代码。这会影响所有 Firefox 用户 （<126），因为 Firefox 使用 PDF.js 来显示 PDF 文件，但也严重影响了许多基于 Web 和 Electron 的应用程序，这些应用程序（间接）使用 PDF.js 进行预览功能。
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
Fix for CVE-2018-15473
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticati
70RISK
open ↗GitHub PoC
Valve Press - CVE-2024-27956-RCE - SQL Injection
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC
Users of JetBrains IDEs at risk of GitHub access token compromise (CVE-2024-37051)
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
48RISK
open ↗GitHub PoC
WanLiChangChengWanLiChang/CVE-2024-23692-RCE
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 4
Fixed and minimalist PoC of the CVE-2024-4577
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 20
PoC for the Veeam Recovery Orchestrator Authentication CVE-2024-29855
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
53RISK
open ↗GitHub PoC★ 25
Ivanti EPM SQL Injection Remote Code Execution Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗VulnCheck XDB
initial-access
Likeshop HTTP POST Request File.php userFormImage unrestricted upload
78RISK
open ↗GitHub PoC
Vietnam National Cyber Security (NCS)'s Internship - 2nd Test
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC
raytran54/CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗VulnCheck XDB
initial-access
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗VulnCheck XDB
initial-access
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC
Rejetto http File Server 2.3.x (Reverse shell)
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC★ 2
POC for CVE-2024-4577 with Shodan integration
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 1
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
75RISK
open ↗VulnCheck XDB
remote-with-credentials
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
63RISK
open ↗GitHub PoC★ 4
jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗VulnCheck XDB
local
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an I
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.