Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,340 exploits
initial-access
FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
50RISK
Exploit-DB
eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to d
41RISK
open ↗initial-access
FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
50RISK
Exploit-DB
Optoma 1080PSTX Firmware C02 - Authentication Bypass
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid cr
60RISK
open ↗initial-access
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RISK
local
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a work
41RISK
Exploit-DB
Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require('child_process').
41RISK
open ↗Exploit-DB
Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
48RISK
open ↗Exploit-DB✓ VexDay Proof
GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file paramete
46RISK
open ↗Exploit-DB
Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pro
41RISK
open ↗Metasploit600
Apache RocketMQ update config RCE
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
100RISK
open ↗Metasploit600
Barracuda ESG TAR Filename Command Injection
Remote Code injection in Barracuda Email Security Gateway
100RISK
open ↗Metasploit300
GitLab Authenticated File Read
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a
85RISK
open ↗Exploit-DB
MobileTrans 4.0.11 - Weak Service Privilege Escalation
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the exe
41RISK
open ↗GitHub PoC★ 30
PoC for CVE-2023-28771 based on Rapid7's excellent writeup
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware vers
100RISK
open ↗GitHub PoC★ 1
vsftpd 2.0.5 - 'CWD' (Authenticated) Remote Memory Consumption
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 throug
28RISK
open ↗GitHub PoC
Dockerized POC for CVE-2022-42889 Text4Shell
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
open ↗GitHub PoC★ 286
CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability.
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RISK
open ↗local
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a work
41RISK
initial-access
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
initial-access
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
70RISK
GitHub PoC
This little script encrypts password to gpp cpassword. It useful to create vulnerable lab AD (CVE-2014-1812).
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windo
98RISK
open ↗initial-access
Unauthenticated Command Injection
100RISK
initial-access
Code Injection in pyload/pyload
85RISK
local
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
local
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc b
60RISK
local
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a work
41RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.