Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,340 exploits
Metasploit600
Greenshot .NET Deserialization Fileformat Exploit
Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .green
38RISK
open ↗Metasploit300
GameOver(lay) Privilege Escalation and Container Escape
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks
56RISK
open ↗Metasploit300
GameOver(lay) Privilege Escalation and Container Escape
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlay
61RISK
open ↗GitHub PoC
Challenge based on CVE-2021-22204 where users send a malicious file to a web application to gain RCE
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗infoleak
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RISK
remote-with-credentials
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
100RISK
GitHub PoC★ 2
Python script to exploit PlaySMS before 1.4.3
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
100RISK
open ↗client-side
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
GitHub PoC★ 1
CVE-2022-23305 Log4J JDBCAppender SQl injection POC
SQL injection in JDBC Appender in Apache Log4j V1
60RISK
open ↗initial-access
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISK
GitHub PoC★ 1
Learn what is BlueJam CVE-2017-0781
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1
28RISK
open ↗initial-access
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex
60RISK
GitHub PoC★ 46
A PoC exploit for CVE-2017-7921 - Hikvision Camera Series Improper Authentication Vulnerability.
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 16
100RISK
open ↗GitHub PoC★ 1
ImageMagick Arbitrary Read Files - CVE-2022-44268
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti
55RISK
open ↗infoleak
Path Traversal: '\..\filename' in mlflow/mlflow
75RISK
infoleak
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv
70RISK
client-side
Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg
50RISK
Metasploit600
Metabase Setup Token RCE
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary comman
60RISK
open ↗initial-access
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex
60RISK
initial-access
Unauthenticated remote code execution
100RISK
infoleak
Unauthenticated remote code execution
100RISK
GitHub PoC★ 1
NetScaler (Citrix ADC) CVE-2023-3519 Scanner
Unauthenticated remote code execution
100RISK
open ↗GitHub PoC★ 11
CVE-2023-3519 vuln for nuclei scanner
Unauthenticated remote code execution
100RISK
open ↗initial-access
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
GitHub PoC
PowerShell Script for initial mitigation of vulnerability
Windows Search Remote Code Execution Vulnerability
93RISK
open ↗Exploit-DB
pfSense v2.7.0 - OS Command Injection
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attac
60RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.