Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,340 exploits
client-side
Cross site scripting
70RISK
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
GitHub PoC★ 5
Exploitation of "Shellshock" Vulnerability. Remote code execution in Apache with mod_cgi
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗initial-access
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
initial-access
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
Metasploit600
OpenTSDB 2.4.1 unauthenticated command injection
Remote Code Execution in OpenTSDB
68RISK
open ↗Metasploit600
OpenNMS Horizon Authenticated RCE
ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN
28RISK
open ↗Metasploit600
OpenTSDB 2.4.1 unauthenticated command injection
Remote Code Execution in OpenTSDB
75RISK
open ↗Metasploit600
OpenNMS Horizon Authenticated RCE
ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/users
36RISK
open ↗GitHub PoC★ 9
WordPress社交登录和注册（Discord，Google，Twitter，LinkedIn）<=7.6.4-绕过身份验证
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
75RISK
open ↗local
Windows Print Spooler Elevation of Privilege Vulnerability
61RISK
GitHub PoC★ 11
Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
63RISK
open ↗initial-access
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
75RISK
initial-access
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
initial-access
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
75RISK
GitHub PoC
yangshifan-git/CVE-2021-1732
Windows Win32k Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC★ 1
Hamesawian/CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗infoleak
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
GitHub PoC★ 4
Using this tool, you can scan for remote command execution vulnerability CVE-2021-44228 on Apache Log4j at multiple addresses.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 82
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
75RISK
open ↗remote-with-credentials
Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution
28RISK
GitHub PoC★ 21
非常简单的CVE-2023-0386's exp and analysis.Use c and sh.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa
86RISK
open ↗local
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa
86RISK
initial-access
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashSe
50RISK
local
Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal
41RISK
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
initial-access
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
local
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISK
GitHub PoC★ 14
A Python script for generating exploits targeting CVE-2022-4510 RCE Binwalk. It supports SSH, command execution, and reverse shell options. Exploits are saved in PNG format. Ideal for testing and demonstrations.
Path Traversal in binwalk
46RISK
open ↗GitHub PoC★ 179
fortra/CVE-2023-28252
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.