Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,340 exploits
GitHub PoC★ 5
Akash7350/CVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗initial-access
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RISK
initial-access
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce
35RISK
GitHub PoC★ 12
Follina (CVE-2022-30190) is a Microsoft Office zero-day vulnerability that has recently been discovered. It’s a high-severity vulnerability that hackers can leverage for remote code execution (RCE) attacks.
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗local
Windows Common Log File System Driver Elevation of Privilege Vulnerability
46RISK
local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
client-side
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
GitHub PoC★ 3
Exploit for CVE-2023-32243 - Unauthorized Account Takeover.
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RISK
open ↗GitHub PoC★ 1
poc
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RISK
open ↗Exploit-DB
FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
TEM FLEX-1085 reboot denial of service
41RISK
open ↗initial-access
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RISK
GitHub PoC★ 7
Exploit for Ubuntu 20.04 using CVE-2021-3156 enhanced with post-exploitation scripts
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗GitHub PoC
raiden757/CVE-2020-17087
Windows Kernel Local Elevation of Privilege Vulnerability
71RISK
open ↗GitHub PoC★ 6
Exploits for Tenda Ac8v4 stack-based overflow to Remote-Code Execution via Mipsel Ropping (CVE-2023-33669 - CVE-2023-33675)
Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c funct
48RISK
open ↗local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
remote-with-credentials
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply
83RISK
GitHub PoC★ 3
R0rt1z2/CVE-2022-38181
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
open ↗info-leak
Weaver e-cology API RequestInfoByXml xml external entity reference
33RISK
GitHub PoC
A simple PoC for CVE-2022-46169 a.k.a Cacti Unauthenticated Command Injection, a vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti prior from version 1.2.17 to 1.2.22
Unauthenticated Command Injection
100RISK
open ↗initial-access
Unauthenticated Command Injection
100RISK
infoleak
Grafana path traversal
100RISK
initial-access
Unauthenticated Command Injection
100RISK
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
GitHub PoC
Baron SameEdit Heap Overflow LPE 1-Day Exploit
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗local
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
GitHub PoC
Ejecución de exploit de deserialización con CVE-2017-5941
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu
35RISK
open ↗GitHub PoC★ 4
redis未授权、redis_CVE-2022-0543检测利用二合一脚本
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
100RISK
open ↗initial-access
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.