Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
89,426cataloged exploits
41,291CVEs with public exploitation
24,696lab-tested
AllReferência 26,792Exploit-DB 24,491GitHub PoC 18,666exploitation intelligence 11,309Nuclei 4,626Metasploit 3,542✓ verified onlyrecentpopularrisk
89,426 exploits
GitHub PoC★ 1
CVE-1999-1053 Proof-of-Concept Exploit
guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remo
60RISK
open ↗initial-access
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISK
initial-access
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
GitHub PoC★ 1
CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISK
open ↗GitHub PoC★ 7
修改版CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
GitHub PoC★ 5
Python Script to exploit RCE of CVE-2022-42889
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
open ↗local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
GitHub PoC
REMOTE CODE EXECUTION found in "OPTILINK OP-XT71000N".
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary
48RISK
open ↗GitHub PoC
ARBITAR FILE UPLOAD LEADS TO "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor , Escalation of Privileges, etc".
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker t
48RISK
open ↗GitHub PoC
REMOTE CODE EXECUTION
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes ar
60RISK
open ↗GitHub PoC★ 8
A Command Line based python tool for exploit Zero-Day vulnerability in MSDT (Microsoft Support Diagnostic Tool) also know as 'Follina' CVE-2022-30190.
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
initial-access
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
60RISK
GitHub PoC
wordpress docker
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
100RISK
open ↗GitHub PoC★ 1
CVE-2022-0441 - MasterStudy LMS 2.7.6
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
60RISK
open ↗initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
initial-access
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
GitHub PoC
Vulnerable configuration Apache HTTP Server version 2.4.49/2.4.50
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗GitHub PoC
Vulnerable configuration Apache HTTP Server version 2.4.49
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
GitHub PoC★ 2
Abdulazizalsewedy/CVE-2021-29447
WordPress Authenticated XXE attack when installation is running PHP 8
63RISK
open ↗initial-access
Remote Code Execution Vulnerability in Packaging
100RISK
initial-access
Microsoft Exchange Server Elevation of Privilege Vulnerability
100RISK
GitHub PoC★ 1
CVE-2021-4034, exploit para escalado de privilegios en SO Linux a root
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC★ 1
A write-up of my (so far inconclusive) look into CVE-2022-31691
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI
48RISK
open ↗Metasploit600
Bitbucket Environment Variable RCE
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker
65RISK
open ↗GitHub PoC★ 2
A massive scanner for CVE-2021-34473 Microsoft Exchange Windows Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
Resources required for building Pluralsight CVE-2022-0847 lab
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗infoleak
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and exploitation-intelligence sources. A public PoC existing does not mean the flaw is exploitable in your environment.