Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
local
CVE-2023-49070—04 Jan 2024
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
60RISK
local
CVE-2021-4034HIGHunder attackransomware04 Jan 2024
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
GitHub PoC★ 1
touch 生成文件
CVE-2021-4034HIGHunder attackransomware04 Jan 2024
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
remote-with-credentials
CVE-2022-21661HIGH04 Jan 2024
SQL injection in WordPress
78RISK
GitHub PoC
julienbrs/exploit-CVE-2023-3460
CVE-2023-3460—04 Jan 2024
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
60RISK
open ↗
initial-access
CVE-2023-27163MEDIUM04 Jan 2024
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
infoleak
CVE-2021-26855CRITICALunder attackransomware04 Jan 2024
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
GitHub PoC
Script to validate WordPress CVE-2022-21661
CVE-2022-21661HIGH04 Jan 2024
SQL injection in WordPress
78RISK
open ↗
initial-access
CVE-2022-22947CRITICALunder attack03 Jan 2024
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
GitHub PoC★ 3
exploit poc
CVE-2022-1388CRITICALunder attackransomware03 Jan 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
local
CVE-2022-0995HIGHunder attack03 Jan 2024
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This
86RISK
GitHub PoC★ 5
CVE-2020-11023 PoC for bug bounty.
CVE-2020-11023MEDIUMunder attack03 Jan 2024
Potential XSS vulnerability in jQuery
85RISK
open ↗
initial-access
CVE-2022-1388CRITICALunder attackransomware03 Jan 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
GitHub PoC
Sumitpathania03/CVE-2022-22947
CVE-2022-22947CRITICALunder attack03 Jan 2024
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
initial-access
CVE-2023-49070—02 Jan 2024
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
60RISK
initial-access
CVE-2023-22515CRITICALunder attackransomware02 Jan 2024
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISK
initial-access
CVE-2023-29357CRITICALunder attackransomware01 Jan 2024
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
infoleak
CVE-2023-1454MEDIUM31 Dec 2023
jeecg-boot qurestSql sql injection
60RISK
initial-access
CVE-2023-35813—31 Dec 2023
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experi
60RISK
local
CVE-2021-3156HIGHunder attack30 Dec 2023
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
GitHub PoC★ 1
DASICS-ICT/DASICS-CVE-2021-3156
CVE-2021-3156HIGHunder attack30 Dec 2023
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
initial-access
CVE-2023-50164—30 Dec 2023
Apache Struts: File upload component had a directory traversal vulnerability
45RISK
GitHub PoC
Repository to exploit CVE-2023-46604 reported for ActiveMQ
CVE-2023-46604CRITICALunder attackransomware30 Dec 2023
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
open ↗
GitHub PoC
Joomla Information disclosure exploit code written in C++.
CVE-2023-23752MEDIUMunder attack29 Dec 2023
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗
GitHub PoC
DARKSTUFF-LAB/-CVE-2022-26134
CVE-2022-26134CRITICALunder attackransomware29 Dec 2023
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗
infoleak
CVE-2023-51467—29 Dec 2023
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
60RISK
infoleak
CVE-2023-51467—29 Dec 2023
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
60RISK
GitHub PoC
rapid-reset-check is a small Go CLI for quickly inventorying HTTPS endpoints that expose HTTP/2 and therefore need a CVE-2023-44487 mitigation review
CVE-2023-44487HIGHunder attack29 Dec 2023
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many
93RISK
open ↗
initial-access
CVE-2023-51467—29 Dec 2023
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
60RISK
local
CVE-2021-4034HIGHunder attackransomware29 Dec 2023
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
← previouspage 643 / 2,974next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.