Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,340cataloged exploits
41,245CVEs with public exploitation
24,696lab-tested
AllReferência 26,769Exploit-DB 24,491GitHub PoC 18,603exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,340 exploits
GitHub PoC★ 4
houqe/EXP_CVE-2018-19518
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh c
60RISK
open ↗initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
100RISK
initial-access
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP reques
68RISK
GitHub PoC
💣💥💀 Proof of Concept: пример запуска fork-бомбы на удаленном сервере благодаря уязвимости CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
local
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
initial-access
Unauthenticated Command Injection
100RISK
infoleak
Directory Transversal Vulnerability in Serv-U 15.3
61RISK
GitHub PoC★ 3
Fixed exploit for CVE-2022-46169 (originally from https://www.exploit-db.com/exploits/51166)
Unauthenticated Command Injection
100RISK
open ↗GitHub PoC★ 3
CVE-2022-38181 POC for FireTV 3rd gen Cube (gazelle)
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
open ↗GitHub PoC★ 7
CVE-2022-38181 POC for FireTV 2nd gen Cube (raven)
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan
76RISK
open ↗infoleak
Minio Information Disclosure in Cluster Deployment
100RISK
initial-access
jeecg-boot qurestSql sql injection
60RISK
GitHub PoC
CHINA-china/MinIO_CVE-2023-28432_EXP
Minio Information Disclosure in Cluster Deployment
100RISK
open ↗Metasploit600
ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy setti
58RISK
open ↗GitHub PoC★ 1
F5 BIG-IP Exploit Using CVE-2022-1388 and CVE-2022-41800
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗initial-access
Appliance mode iControl REST vulnerability
78RISK
initial-access
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
GitHub PoC
FzBacon/CVE-2023-25234_Tenda_AC6_stack_overflow
Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInte
53RISK
open ↗GitHub PoC
nik0nz7/CVE-2020-14882
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗initial-access
Unauthenticated Command Injection
100RISK
GitHub PoC
Unauthenticated Remote Code Execution through authentication bypass and command injection in Cacti < 1.2.23 and < 1.3.0
Unauthenticated Command Injection
100RISK
open ↗Metasploit300
CVE-2023-21554 - QueueJumper - MSMQ RCE Check
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
85RISK
open ↗initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
initial-access
jeecg-boot qurestSql sql injection
60RISK
Metasploit400
Windows Common Log File System Driver (clfs.sys) Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
98RISK
open ↗GitHub PoC★ 3
QloApp 1.5.2: Vulnerable to XSS on two Parameter (email_create and back)
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
48RISK
open ↗Exploit-DB
Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
41RISK
open ↗Exploit-DB
Paradox Security Systems IPR512 - Denial Of Service
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and l
53RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.