Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,899 exploits
VulnCheck XDB
initial-access
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
85RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85257 — Apache Camel camel-cxf SOAP fault information disclosure (CWE-209); Spring Boot + Quarkus, affected vs fixed
Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
33RISK
open ↗GitHub PoC
CVE-2026-16723 reproduction toolkit - fastjson 1.2.83 jar: remote class-loading payload generator (ASM-built POC.class with @JSONType + clinit exec)
Remote Code Execution in fastjson 1.2.68–1.2.83
48RISK
open ↗VulnCheck XDB
initial-access
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
63RISK
open ↗GitHub PoC
Reproducer for CVE-2026-84178 (Apache Camel camel-oauth): the authorization-code callback redeems the code without verifying a state parameter (login CSRF) — Camel Spring Boot + Camel Quarkus
Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
33RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85248 — Apache Camel camel-pqc concurrent Signature race / verification bypass (CWE-362); Spring Boot + Quarkus, affected vs fixed
Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
33RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85247 — Apache Camel camel-knative improper certificate validation (CWE-295); Spring Boot + Quarkus, affected vs fixed
Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
33RISK
open ↗GitHub PoC
HDU IS Lab Work 1: secure Flask REST API with CI/CD and CVE-2024-23334 analysis
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISK
open ↗GitHub PoC★ 1
A detailed cybersecurity analysis of CVE-2011-2523, a critical backdoor vulnerability associated with a compromised vsftpd 2.3.4 distribution in 2011. This repository explains the vulnerability, its technical mechanism, severity, potential impact, software supply-chain risks, and recommended mitigation strategies for educational purposes.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC
Cyber Security Assignment analyzing CVE-2024-6387, its severity, patch and etc
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗GitHub PoC
Cybersecurity assignment analysing CVE-2024-3400, its severity, patch, Cyber Kill Chain, and incident response.
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RISK
open ↗GitHub PoC
Log4Shell (CVE-2021-44228) remediation paperwork and log4j-core advisory audit for the payments service
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Cybersecurity assignment on CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗GitHub PoC
wonnnggge/CVE-2024-27198_CTF
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
100RISK
open ↗GitHub PoC
ydkdk12345-bot/CVE-2024-23897-CTF
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85249 — Apache Camel camel-tika metadata header injection (CWE-20); Spring Boot + Quarkus, affected vs fixed
Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
33RISK
open ↗GitHub PoC
Research for CYB 401
Glibc: buffer overflow in ld.so leading to privilege escalation
98RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85243 — Apache Camel camel-crypto-pgp integrity verification downgrade (CWE-354); Spring Boot + Quarkus, affected vs fixed
Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure
33RISK
open ↗GitHub PoC
Secure REST API with CI security scanning and CVE-2021-41773 reproduction/fix
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC
CVE-2026-75045 - JetBrains YouTrack unauthenticated database backup download via shared draft signature (CVSS 9.1)
In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download data
48RISK
open ↗GitHub PoC
Reproducer for CVE-2026-84176 (Apache Camel camel-platform-http-vertx): CORS handler sends Access-Control-Allow-Credentials: true outside the origin check and reflects the Origin when no origins are configured (credentialed any-origin) — Camel Spring Boot
Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
33RISK
open ↗GitHub PoC
Reproducer for CVE-2026-84181 — Apache Camel camel-shiro thread-bound-subject authentication bypass (CWE-287); Spring Boot + Quarkus, affected vs fixed
Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.