Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

89,220cataloged exploits

41,197CVEs with public exploitation

24,696lab-tested

All Referência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecent popular risk

89,220 exploits

GitHub PoC

tannlh/CVE-2018-20250

CVE-2018-20250HIGHunder attackransomware26 Dec 2023

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISK

open ↗

client-side

CVE-2023-38831HIGHunder attackransomware26 Dec 2023

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISK

GitHub PoC

kimstars/POC-CVE-2022-28117

CVE-2022-28117—26 Dec 2023

A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the ap

43RISK

open ↗

GitHub PoC★ 11

🔐 "PWNTAPO: Unveiling Command Injection in TP-Link Tapo C200 Cameras (<= v1.1.16 Build 211209)" 🔓

CVE-2021-4045CRITICAL26 Dec 2023

TP-LINK Tapo C200 remote code execution vulnerability

70RISK

open ↗

infoleak

CVE-2023-26360HIGHunder attack26 Dec 2023

Adobe ColdFusion Improper Access Control Arbitrary code execution

100RISK

initial-access

CVE-2023-41892CRITICAL26 Dec 2023

Craft CMS Remote Code Execution vulnerability

85RISK

client-side

CVE-2018-20250HIGHunder attackransomware26 Dec 2023

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISK

GitHub PoC★ 1

This is a exploit of CVE-2021-32305 a web vulnerability to command injection on search.php path, this exploit allows execute commands.

CVE-2021-32305—26 Dec 2023

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search paramet

60RISK

open ↗

GitHub PoC★ 1

MkJos/CVE-2023-33246_RocketMQ_RCE_EXP

CVE-2023-33246CRITICALunder attack26 Dec 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

GitHub PoC★ 2

Exploit Development using python for CVE-2023-38831 (POC)

CVE-2023-38831HIGHunder attackransomware26 Dec 2023

RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a

100RISK

open ↗

GitHub PoC★ 5

Exploit for Arbitrary File Read for CVE-2023-26360 - Adobe Coldfusion

CVE-2023-26360HIGHunder attack26 Dec 2023

Adobe ColdFusion Improper Access Control Arbitrary code execution

100RISK

open ↗

GitHub PoC★ 1

TP-Link Archer AX21 - Unauthenticated Command Injection [Loader]

CVE-2023-1389HIGHunder attack25 Dec 2023

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i

100RISK

open ↗

GitHub PoC★ 1

Welcome to the Metasploit Exploits Repository, your go-to resource for a comprehensive collection of cutting-edge exploits designed for penetration testing and ethical hacking. Developed and maintained by Mohamed Mounir Boudjema, this repository is crafted with a deep understanding of the evolving landscape of cybersecurity.

CVE-2023-6710MEDIUM25 Dec 2023

Mod_cluster/mod_proxy_cluster: stored cross site scripting

33RISK

open ↗

GitHub PoC★ 13

dust-life/CVE-2019-18935-memShell

CVE-2019-18935CRITICALunder attackransomware25 Dec 2023

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

100RISK

open ↗

initial-access

CVE-2023-27524HIGHunder attack25 Dec 2023

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

100RISK

GitHub PoC★ 2

Explore the depths of CVE-2023-6710 with our comprehensive Proof of Concept (PoC). This CVE, identified as a potential security vulnerability, has been meticulously examined to demonstrate its impact and provide a hands-on understanding of the associated risks.

CVE-2023-6710MEDIUM25 Dec 2023

Mod_cluster/mod_proxy_cluster: stored cross site scripting

33RISK

open ↗

Metasploit600

Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution

CVE-2023-7102—24 Dec 2023

Remote Code Execution (RCE) Vulnerability

30RISK

open ↗

Metasploit600

Barracuda ESG Spreadsheet::ParseExcel Arbitrary Code Execution

CVE-2023-7101HIGHunder attack24 Dec 2023

Arbitrary Code Execution (ACE) Vulnerability

71RISK

open ↗

initial-access

CVE-2023-23752MEDIUMunder attack24 Dec 2023

[20230201] - Core - Improper access check in webservice endpoints

100RISK

GitHub PoC★ 18

puckiestyle/CVE-2023-0386

CVE-2023-0386HIGHunder attack23 Dec 2023

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RISK

open ↗

local

CVE-2023-4911HIGHunder attack23 Dec 2023

Glibc: buffer overflow in ld.so leading to privilege escalation

98RISK

GitHub PoC

CVE-2023-46604 - ApacheMQ Version 5.15.5 Vulnerability Machine: Broker

CVE-2023-46604CRITICALunder attackransomware23 Dec 2023

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISK

open ↗

local

CVE-2023-0386HIGHunder attack23 Dec 2023

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RISK

initial-access

CVE-2023-46604CRITICALunder attackransomware23 Dec 2023

Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

100RISK

GitHub PoC★ 2

puckiestyle/CVE-2023-4911

CVE-2023-4911HIGHunder attack23 Dec 2023

Glibc: buffer overflow in ld.so leading to privilege escalation

98RISK

open ↗

GitHub PoC★ 16

CVE-2023-50254: PoC Exploit for Deepin-reader RCE that affects unpatched Deepin Linux Desktops. Deepin Linux's default document reader "deepin-reader" software suffers from a serious vulnerability due to a design flaw that leads to Remote Command Execution via crafted docx document.

CVE-2023-50254CRITICAL22 Dec 2023

Deepin Reader RCE vulnerability due to a design flaw

48RISK

open ↗

initial-access

CVE-2016-4437CRITICALunder attack22 Dec 2023

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack

100RISK

GitHub PoC★ 2

Python POC to Exploit CVE-2016-4437 Apache Shiro Deserialization Vulnerability Due to Hardcode Encryption Key

CVE-2016-4437CRITICALunder attack22 Dec 2023

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack

100RISK

open ↗

GitHub PoC★ 4

Guillaume-Risch/cve-2023-29357-Sharepoint

CVE-2023-29357CRITICALunder attackransomware22 Dec 2023

Microsoft SharePoint Server Elevation of Privilege Vulnerability

100RISK

open ↗

remote-with-credentials

CVE-2019-1003001—21 Dec 2023

A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins

60RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.