Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,287cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,490GitHub PoC 18,551exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,287 exploits
initial-access
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
GitHub PoC★ 3
CVE-2023-36845 - Juniper Firewall Remote code execution (RCE)
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗initial-access
Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
50RISK
GitHub PoC
go CVE-2023-24538 patch issue resolver - Dunfell
Backticks not treated as string delimiters in html/template
48RISK
open ↗GitHub PoC★ 5
Scans an executable and determines if it was wrapped in an Electron version vulnerable to the Chromium vulnerability CVE-2023-4863/ CVE-2023-5129
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to
93RISK
open ↗infoleak
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
initial-access
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISK
GitHub PoC
go CVE-2023-24538 patch issue resolver - Kirkstone
Backticks not treated as string delimiters in html/template
48RISK
open ↗GitHub PoC
jytmX/CVE-2021-24499
Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
50RISK
open ↗GitHub PoC★ 45
JetBrains TeamCity Authentication Bypass CVE-2023-42793 Exploit
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISK
open ↗GitHub PoC★ 41
MS Office and Windows HTML RCE (CVE-2023-36884) - PoC and exploit
Windows Search Remote Code Execution Vulnerability
93RISK
open ↗client-side
Windows Search Remote Code Execution Vulnerability
93RISK
infoleak
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensiti
68RISK
GitHub PoC★ 3
PoC for Stored XSS (CVE-2023-43770) Vulnerability
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craft
75RISK
open ↗infoleak
Fusion Builder < 3.6.2 - Unauthenticated SSRF
60RISK
client-side
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craft
75RISK
GitHub PoC★ 9
CVE-2023-34152
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob wit
48RISK
open ↗client-side
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a
83RISK
infoleak
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
infoleak
JumpServer session replays download without authentication
68RISK
GitHub PoC
sherlocksecurity/CVE-2023-4762-Code-Review
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a
83RISK
open ↗Metasploit600
Progress Software WS_FTP Unauthenticated Remote Code Execution
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
100RISK
open ↗GitHub PoC★ 24
buptsb/CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a
83RISK
open ↗Metasploit600
Kafka UI Unauthenticated Remote Command Execution via the Groovy Filter option.
An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the
78RISK
open ↗GitHub PoC★ 34
A Proof-Of-Concept for the CVE-2023-43770 vulnerability.
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craft
75RISK
open ↗GitHub PoC★ 1
halencarjunior/CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗initial-access
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
GitHub PoC★ 239
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC★ 55
Juniper Firewalls CVE-2023-36845 - RCE
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
100RISK
open ↗GitHub PoC★ 1
New exploitation of 2020 Sophos vuln
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.