Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
GitHub PoC★ 4
High CVE-2024-4761 Exploit
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds
76RISK
open ↗GitHub PoC★ 15
aelmokhtar/CVE-2024-34716
PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
60RISK
open ↗initial-access
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
initial-access
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RISK
GitHub PoC
CVE-2024-34832
Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a craf
48RISK
open ↗GitHub PoC★ 5
jakabakos/CVE-2023-26360-adobe-coldfusion-rce-exploit
Adobe ColdFusion Improper Access Control Arbitrary code execution
100RISK
open ↗GitHub PoC★ 2
Checker for CVE-2021-3156 with static version check
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗client-side
WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability
68RISK
Exploit-DB
Apache mod_proxy_cluster 1.2.6 - Stored XSS
Mod_cluster/mod_proxy_cluster: stored cross site scripting
33RISK
open ↗GitHub PoC★ 1
Updated python3 exploit for CVE-2018-10583 (LibreOffice/Open Office - '.odt' Information Disclosure )
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically p
60RISK
open ↗infoleak
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RISK
GitHub PoC
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
Unauthenticated arbitrary file read and remote code execution in CrushFTP
100RISK
open ↗GitHub PoC★ 2
POC for CVE-2024-4701
Path Traversal vulnerability via File Uploads in Genie
53RISK
open ↗initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
initial-access
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RISK
infoleak
Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
56RISK
client-side
WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability
68RISK
GitHub PoC
andrelia-hacks/CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RISK
open ↗GitHub PoC★ 7
Kernel Exploit for CVE-2016-6187 (Local Privilege Escalation)
The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buff
23RISK
open ↗infoleak
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISK
infoleak
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISK
GitHub PoC★ 2
Apache Superset - Authentication Bypass
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISK
open ↗client-side
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
infoleak
Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
56RISK
GitHub PoC★ 1
Tool for finding CVE-2023-27524 (Apache Superset - Authentication Bypass)
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
100RISK
open ↗GitHub PoC
th3Hellion/CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
100RISK
open ↗infoleak
Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
48RISK
GitHub PoC
rasan2001/CVE-2023-27350-Ongoing-Exploitation-of-PaperCut-Remote-Code-Execution-Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
100RISK
open ↗GitHub PoC
Shelly is a lightweight and efficient vulnerability scanner designed to identify and mitigate Shellshock (CVE-2014-6271 & CVE-2014-7169) vulnerabilities in Bash environments.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.