Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

89,426cataloged exploits
41,291CVEs with public exploitation
24,696lab-tested
AllReferência 26,792Exploit-DB 24,491GitHub PoC 18,666exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,426 exploits
Exploit-DB✓ VexDay Proof
Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
CVE-2023-23161—webappsphp03 Apr 2023
A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to e
38RISK
open ↗
Exploit-DB
GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion
CVE-2022-31062MEDIUMwebappsphp03 Apr 2023
Unauthenticated Local File Inclusion
33RISK
open ↗
Exploit-DB
Windows 11 10.0.22000 - Backup service Privilege Escalation
CVE-2023-21752HIGHlocalwindows03 Apr 2023
Windows Backup Service Elevation of Privilege Vulnerability
41RISK
open ↗
Exploit-DB
GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
CVE-2022-34128CRITICALwebappsphp03 Apr 2023
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data
48RISK
open ↗
Exploit-DB
Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
CVE-2023-0084HIGHwebappsphp03 Apr 2023
Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
46RISK
open ↗
Exploit-DB
sleuthkit 4.11.1 - Command Injection
CVE-2022-45639HIGHlocalmultiple03 Apr 2023
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a cra
41RISK
open ↗
Exploit-DB
Nacos 2.0.3 - Access Control vulnerability
CVE-2021-43116—webappsjava03 Apr 2023
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on l
23RISK
open ↗
infoleak
CVE-2014-0160HIGHunder attack03 Apr 2023
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
Exploit-DB
GLPI v10.0.2 - SQL Injection (Authentication Depends on Configuration)
CVE-2022-31056CRITICALwebappsphp03 Apr 2023
SQL injection with _actor parameter in GLPI
48RISK
open ↗
Exploit-DB
Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
CVE-2022-31161CRITICALwebappspython03 Apr 2023
Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload
68RISK
open ↗
initial-access
CVE-2014-6271CRITICALunder attack03 Apr 2023
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
Exploit-DB✓ VexDay Proof
Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated
CVE-2023-23162—webappsphp03 Apr 2023
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter
23RISK
open ↗
Exploit-DB✓ VexDay Proof
WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE
CVE-2020-25213CRITICALunder attackwebappsphp03 Apr 2023
The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra
100RISK
open ↗
local
CVE-2016-5195HIGHunder attack03 Apr 2023
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
Exploit-DB
SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS)
CVE-2022-47870MEDIUMwebappsmultiple03 Apr 2023
A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows r
33RISK
open ↗
Exploit-DB
GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
CVE-2022-34127HIGHwebappsphp03 Apr 2023
The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.p
41RISK
open ↗
Exploit-DB✓ VexDay Proof
Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection
CVE-2023-23488CRITICALwebappsphp03 Apr 2023
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerabilit
85RISK
open ↗
GitHub PoC★ 2
my python poc CVE-2023-24774 and CVE-2023-24775 this sqli cve funadmin
CVE-2023-24775CRITICAL03 Apr 2023
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member
53RISK
open ↗
Exploit-DB
sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
CVE-2023-22809HIGHlocallinux03 Apr 2023
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
68RISK
open ↗
Exploit-DB✓ VexDay Proof
Roxy WI v6.1.0.0 - Improper Authentication Control
CVE-2022-31125CRITICALwebappspython03 Apr 2023
Authentication Bypass in Roxy-wi
53RISK
open ↗
GitHub PoC★ 1
A vulnerable Spring Boot application that uses log4j and is vulnerable to CVE-2021-44228, CVE-2021-44832, CVE-2021-45046 and CVE-2021-45105
CVE-2021-44228CRITICALunder attackransomware02 Apr 2023
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗
GitHub PoC
Struts2 S2-061 远程命令执行漏洞（CVE-2020-17530）
CVE-2020-17530CRITICALunder attack02 Apr 2023
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected
100RISK
open ↗
initial-access
CVE-2020-17530CRITICALunder attack02 Apr 2023
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected
100RISK
GitHub PoC
exploit for CVE-2021-22911 in rust
CVE-2021-22911—01 Apr 2023
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗
Exploit-DB
Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)
CVE-2022-44877CRITICALunder attackwebappslinux01 Apr 2023
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execut
100RISK
open ↗
initial-access
CVE-2021-22911—01 Apr 2023
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
Exploit-DB
AD Manager Plus 7122 - Remote Code Execution (RCE)
CVE-2021-44228CRITICALunder attackransomwareremotejava01 Apr 2023
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗
Exploit-DB✓ VexDay Proof
Apache 2.4.x - Buffer Overflow
CVE-2021-44790—webappsmultiple01 Apr 2023
Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
45RISK
open ↗
Exploit-DB
Enlightenment v0.25.3 - Privilege escalation
CVE-2022-37706HIGHlocallinux01 Apr 2023
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and th
56RISK
open ↗
GitHub PoC
devAL3X/CVE-2022-46169_poc
CVE-2022-46169CRITICALunder attack01 Apr 2023
Unauthenticated Command Injection
100RISK
open ↗
← previouspage 726 / 2,981next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.