Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,296cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,490GitHub PoC 18,560exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,304 exploits
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
GitHub PoC★ 1
CVE-2023-33246 POC
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISK
open ↗GitHub PoC★ 3
Prestashop fix vulnerability CVE-2023-39526 & CVE-2023-39527
PrestaShopSQL manager vulnerability (potential RCE)
48RISK
open ↗GitHub PoC★ 65
mandiant/citrix-ioc-scanner-cve-2023-3519
Unauthenticated remote code execution
100RISK
open ↗GitHub PoC
yosef0x01/CVE-2023-21752
Windows Backup Service Elevation of Privilege Vulnerability
41RISK
open ↗Exploit-DB
TP-Link Archer AX21 - Unauthenticated Command Injection
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i
100RISK
open ↗GitHub PoC
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
75RISK
open ↗initial-access
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
70RISK
client-side
PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise
38RISK
GitHub PoC★ 52
PoC for the recent critical vuln affecting OpenSSH versions < 9.3p2
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
70RISK
open ↗initial-access
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RISK
initial-access
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RISK
Metasploit600
PRTG CVE-2023-32781 Authenticated RCE
A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an au
23RISK
open ↗initial-access
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
75RISK
initial-access
D-Link DAR-8000-10 sys1.php os command injection
70RISK
infoleak
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
Exploit-DB
Emagic Data Center Management Suite v6.0 - OS Command Injection
OS Command Injection Vulnerability in Emagic Data Center Management Suite
53RISK
open ↗Metasploit600
CrushFTP Unauthenticated RCE
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
60RISK
open ↗Exploit-DB
Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template in
35RISK
open ↗Exploit-DB
Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
Templatecookie Adlisting Redirect ad-list information disclosure
60RISK
open ↗Exploit-DB✓ VexDay Proof
Social-Commerce 3.1.6 - Reflected XSS
mooSocial mooStore cross site scripting
43RISK
open ↗Exploit-DB✓ VexDay Proof
mooSocial 3.1.8 - Reflected XSS
mooSocial mooStore index cross site scripting
43RISK
open ↗GitHub PoC★ 10
CVE exploitation for WebKit jsc CVE-2018-4416
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iO
35RISK
open ↗GitHub PoC
Original Exploit Source: https://www.exploit-db.com/exploits/46635
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗initial-access
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
68RISK
client-side
Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update
43RISK
GitHub PoC
Campcodes Online Matrimonial Website System 3.3 Cross Site Scripting
install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG docum
23RISK
open ↗GitHub PoC
MrE-Fog/jboss-_CVE-2017-12149
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISK
open ↗initial-access
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.