Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,426cataloged exploits
41,291CVEs with public exploitation
24,696lab-tested
AllReferência 26,792Exploit-DB 24,491GitHub PoC 18,666exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,426 exploits
GitHub PoC★ 2
Tenda f3 Malformed HTTP Request Header Processing Vulnerability.
Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_pas
60RISK
open ↗initial-access
IBM Aspera Faspex code execution
100RISK
local
Windows Win32k Elevation of Privilege Vulnerability
100RISK
GitHub PoC★ 8
Bulk scanner + get config from CVE-2023-23752
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗client-side
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a
93RISK
client-side
Microsoft Word Remote Code Execution Vulnerability
70RISK
local
Microsoft Word Remote Code Execution Vulnerability
70RISK
GitHub PoC★ 59
A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as an email attachment (or other means).
Microsoft Word Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
Results of retrohunt for files matching YARA rules from https://github.com/AmgdGocha/Detection-Rules/blob/main/CVE-2023-21716.yar
Microsoft Word Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
Script in Ruby for the CVE-2022-35914 - RCE in GLPI
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗GitHub PoC★ 46
RTF Crash POC Python 3.11 Windows 10
Microsoft Word Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC★ 4
FeatherStark/CVE-2023-21716
Microsoft Word Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC★ 1
adriyansyah-mf/CVE-2023-23752
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗GitHub PoC★ 8
spring cloud function 一键利用工具! by charis 博客https://charis3306.top/
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
open ↗GitHub PoC
rahmadsandy/EXIM-4.87-CVE-2019-10149
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message(
100RISK
open ↗client-side
Microsoft Word Remote Code Execution Vulnerability
70RISK
client-side
Microsoft Word Remote Code Execution Vulnerability
70RISK
client-side
Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially explo
60RISK
infoleak
[20230201] - Core - Improper access check in webservice endpoints
100RISK
initial-access
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISK
initial-access
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
Metasploit300
Pretalx Arbitrary File Read/Limited File Write
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload craft
28RISK
open ↗Metasploit300
Pretalx Arbitrary File Read/Limited File Write
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the over
28RISK
open ↗Metasploit600
Pretalx Limited File Write to Remote Code Execution
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the over
28RISK
open ↗GitHub PoC★ 1
Pada bulan maret 2023, terdapat sample baru yang terindentifikasi sebagai malware. Malware tersebut berasal dari file berekstensi.xls dan .doc dan dikenal dengan nama “Bank Slip.xls”. Aktivitas malware tersebut memiliki hubungan dengan kerentanan yang dikenal dengan id CVE-2017-11882 dan CVE-2018-0802.
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi
100RISK
open ↗GitHub PoC★ 1
Pada bulan maret 2023, terdapat sample baru yang terindentifikasi sebagai malware. Malware tersebut berasal dari file berekstensi.xls dan .doc dan dikenal dengan nama “Bank Slip.xls”. Aktivitas malware tersebut memiliki hubungan dengan kerentanan yang dikenal dengan id CVE-2017-11882 dan CVE-2018-0802.
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow
93RISK
open ↗GitHub PoC★ 2
CVE-2022-31814
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISK
open ↗initial-access
Fusion Builder < 3.6.2 - Unauthenticated SSRF
60RISK
initial-access
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.