Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,426cataloged exploits
41,291CVEs with public exploitation
24,696lab-tested
AllReferência 26,792Exploit-DB 24,491GitHub PoC 18,666exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,426 exploits
initial-access
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
remote-with-credentials
Microsoft Exchange Server Elevation of Privilege Vulnerability
93RISK
GitHub PoC★ 1
ohnonoyesyes/CVE-2022-41080
Microsoft Exchange Server Elevation of Privilege Vulnerability
93RISK
open ↗local
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macO
68RISK
GitHub PoC★ 26
Exploits GitLab authenticated RCE vulnerability known as CVE-2022-2884.
A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3
70RISK
open ↗GitHub PoC★ 14
CVE-2021-42287/CVE-2021-42278 Exploiter
Active Directory Domain Services Elevation of Privilege Vulnerability
93RISK
open ↗remote-with-credentials
Microsoft Exchange Server Elevation of Privilege Vulnerability
93RISK
remote-with-credentials
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
GitHub PoC★ 93
PoC for the CVE-2022-41080 , CVE-2022-41082 and CVE-2022-41076 Vulnerabilities Affecting Microsoft Exchange Servers
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
GitHub PoC
this exemple of application permet to test the vunerability CVE_2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗GitHub PoC★ 2
devengpk/CVE-2022-1388
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗initial-access
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
GitHub PoC
CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗initial-access
Adobe Commerce checkout improper input validation leads to remote code execution
100RISK
GitHub PoC★ 4
🐍 Python Exploit for CVE-2021-45010
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7
45RISK
open ↗GitHub PoC
devengpk/CVE-2022-36804
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗initial-access
Unauthenticated sensitive information disclosure
100RISK
initial-access
Unauthenticated remote code execution
100RISK
GitHub PoC★ 6
Proof of concept of CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
100RISK
open ↗initial-access
IBM Aspera Faspex code execution
100RISK
initial-access
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
GitHub PoC★ 1
devengpk/CVE-2022-29464
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗local
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macO
68RISK
initial-access
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
GitHub PoC
Drupal CVE-2018-7600 RCE Pseudo-Shell PoC
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗Metasploit600
macOS Dirty Cow Arbitrary File Write Local Privilege Escalation
A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macO
68RISK
open ↗GitHub PoC
By passing an overly large string when invoking nethack, it is possible to corrupt memory. jnethack and falconseye are also prone to this vulnerability.
Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allow
23RISK
open ↗GitHub PoC★ 1
CVE-2022-46169 - Cacti Blind Remote Code Execution (Pre-Auth)
Unauthenticated Command Injection
100RISK
open ↗initial-access
Unauthenticated Command Injection
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.