Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,340 exploits
GitHub PoC★ 57
Openfire Console Authentication Bypass Vulnerability with RCE plugin
Openfire administration console authentication bypass
100RISK
open ↗GitHub PoC★ 1
CVE-2023-24078 for FuguHub / BarracudaDrive
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the c
53RISK
open ↗GitHub PoC★ 23
FortiOS 管理界面中的堆内存下溢导致远程代码执行
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0
53RISK
open ↗GitHub PoC★ 7
CVE-2023-24078 for FuguHub / BarracudaDrive
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the c
53RISK
open ↗initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
client-side
WordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)
68RISK
GitHub PoC★ 6
Repository with everything I have tracking the impact of MOVEit CVE-2023-34362
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.
100RISK
open ↗GitHub PoC★ 5
Joomla未授权访问漏洞
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗infoleak
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
initial-access
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
initial-access
[20230201] - Core - Improper access check in webservice endpoints
100RISK
GitHub PoC★ 15
SolarView Compact through 6.00 downloader.php commands injection (RCE) nuclei-templates
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassin
85RISK
open ↗initial-access
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassin
85RISK
GitHub PoC
In Paradox Security System IPR512 Web console login form page, attacker can input JavaScript string, such as "</script>" that will overwrite configurations in the file "login.xml" and cause the login page to crash.
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and l
53RISK
open ↗GitHub PoC★ 134
Safely detect whether a FortiGate SSL VPN instance is vulnerable to CVE-2023-27997 based on response timing
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
open ↗GitHub PoC
CVE-2023-34600
Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.
53RISK
open ↗GitHub PoC★ 27
POC FortiOS SSL-VPN buffer overflow vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
100RISK
open ↗Metasploit600
Rudder Server SQLI Remote Code Execution
rudder-server vulnerable to SQL Injection
58RISK
open ↗GitHub PoC
Samba 3.0.20
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗GitHub PoC★ 2
5rGJ5aCh5oCq5YW9/CVE-2023-32315exp
Openfire administration console authentication bypass
100RISK
open ↗initial-access
Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
38RISK
GitHub PoC
Exploit for CVE-2022-44136 for chcking security of your site
Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
48RISK
open ↗initial-access
Code Injection in pyload/pyload
85RISK
initial-access
Openfire administration console authentication bypass
100RISK
initial-access
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware
100RISK
initial-access
Openfire administration console authentication bypass
100RISK
infoleak
Openfire administration console authentication bypass
100RISK
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
initial-access
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute
60RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.