Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

89,220cataloged exploits
41,197CVEs with public exploitation
24,696lab-tested
AllReferência 26,738Exploit-DB 24,490GitHub PoC 18,525exploitation intelligence 11,299Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,220 exploits
initial-access
CVE-2020-2551CRITICALunder attack20 Dec 2023
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Suppor
100RISK
initial-access
CVE-2022-24989—20 Dec 2023
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskst
50RISK
infoleak
CVE-2023-23752MEDIUMunder attack20 Dec 2023
[20230201] - Core - Improper access check in webservice endpoints
100RISK
infoleak
CVE-2023-27350CRITICALunder attackransomware20 Dec 2023
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui
100RISK
initial-access
CVE-2023-25280CRITICALunder attack20 Dec 2023
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a cr
100RISK
client-side
CVE-2023-23397CRITICALunder attack20 Dec 2023
Microsoft Outlook Elevation of Privilege Vulnerability
100RISK
remote-with-credentials
CVE-2019-8942—20 Dec 2023
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry ca
60RISK
initial-access
CVE-2016-0638—20 Dec 2023
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
35RISK
info-leak
CVE-2021-31196HIGHunder attack20 Dec 2023
Microsoft Exchange Server Remote Code Execution Vulnerability
83RISK
initial-access
CVE-2022-22947CRITICALunder attack20 Dec 2023
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
client-side
CVE-2022-28368—20 Dec 2023
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (
60RISK
initial-access
CVE-2021-26295—20 Dec 2023
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
60RISK
remote-with-credentials
CVE-2020-0688HIGHunder attackransomware20 Dec 2023
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o
100RISK
initial-access
CVE-2019-6340HIGHunder attack20 Dec 2023
Drupal core - Highly critical - Remote Code Execution
100RISK
remote-with-credentials
CVE-2022-26809CRITICAL20 Dec 2023
Remote Procedure Call Runtime Remote Code Execution Vulnerability
70RISK
infoleak
CVE-2023-27163MEDIUM20 Dec 2023
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
infoleak
CVE-2023-22894HIGHunder attack20 Dec 2023
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting
71RISK
local
CVE-2023-22809HIGH20 Dec 2023
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
68RISK
infoleak
CVE-2023-27587HIGH20 Dec 2023
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing
56RISK
initial-access
CVE-2021-21983—20 Dec 2023
Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authent
50RISK
initial-access
CVE-2020-1472MEDIUMunder attackransomware20 Dec 2023
Netlogon Elevation of Privilege Vulnerability
100RISK
info-leak
CVE-2015-7857—20 Dec 2023
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p
60RISK
client-side
CVE-2022-30190HIGHunder attackransomware20 Dec 2023
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
GitHub PoC
That-Guy-Steve/CVE-2018-1133-Exploit
CVE-2018-1133—20 Dec 2023
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code exec
35RISK
open ↗
initial-access
CVE-2019-6340HIGHunder attack20 Dec 2023
Drupal core - Highly critical - Remote Code Execution
100RISK
client-side
CVE-2022-30190HIGHunder attackransomware20 Dec 2023
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
initial-access
CVE-2023-34362CRITICALunder attackransomware20 Dec 2023
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RISK
initial-access
CVE-2009-3103—20 Dec 2023
Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Window
60RISK
infoleak
CVE-2023-23752MEDIUMunder attack20 Dec 2023
[20230201] - Core - Improper access check in webservice endpoints
100RISK
initial-access
CVE-2023-38408CRITICAL20 Dec 2023
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
70RISK
← previouspage 653 / 2,974next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.