Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
exploitation intelligence
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
GitHub PoC
NanoWraith/CVE-2024-25600
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗GitHub PoC
CVE-2024-4295 Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
68RISK
open ↗exploitation intelligence
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
GitHub PoC★ 4
conan-sudo/CVE-2019-14974-bypass
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
43RISK
open ↗GitHub PoC
NanoWraith/CVE-2024-5084
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
75RISK
open ↗Metasploit600
PHP CGI Argument Injection Remote Code Execution
Argument Injection in PHP-CGI
100RISK
open ↗exploitation intelligence
remote-with-credentials
Netlogon Elevation of Privilege Vulnerability
100RISK
exploitation intelligence
initial-access
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to
60RISK
exploitation intelligence
infoleak
Information disclosure
100RISK
GitHub PoC
A script to exploit CVE-2020-1472 (Zerologon)
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC
muhammad1596/CVE-2022-0847-DirtyPipe-Exploits
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗exploitation intelligence
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
GitHub PoC★ 1
A Simple Exploit Code(POC) to Automate CVE-2024–24919
Information disclosure
100RISK
open ↗exploitation intelligence
info-leak
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
68RISK
exploitation intelligence
initial-access
XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update
41RISK
GitHub PoC
DigitalNinja00/CVE-2018-1335
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to
60RISK
open ↗GitHub PoC
CVE-2017-8917 SQL injection Vulnerability in Joomla! 3.7.0 exploit
SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspeci
60RISK
open ↗GitHub PoC★ 9
CVE-2024-4956 Python exploitation utility
Nexus Repository 3 - Path Traversal
61RISK
open ↗GitHub PoC
This script will inform the user if the Confluence instance is vulnerable, but it will not proceed with the exploitation steps.
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISK
open ↗GitHub PoC
CVE-2021-1675/CVE-2021-34527 PrintNightmare & CVE-2020-0668
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
open ↗exploitation intelligence
local
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
exploitation intelligence
infoleak
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
68RISK
exploitation intelligence
initial-access
Registration Authentication Bypass Vulnerability
100RISK
GitHub PoC★ 24
Sk1dr0wz/CVE-2024-4358_Mass_Exploit
Registration Authentication Bypass Vulnerability
100RISK
open ↗GitHub PoC★ 1
Oracle WebLogic Server (LFI)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported ve
78RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.