Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
71,886 exploits
GitHub PoC★ 3
Automating the exploitation of CVE-2026-7299 - Stored XSS via Database Table/Column Names in SQL Autocomplete within Appsmith =>1.99. Initial discovery 30/03/26
CVE-2026-7299
33RISK
open ↗VulnCheck XDB
initial-access
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISK
open ↗GitHub PoC
Hoverfly CVE RCE
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISK
open ↗GitHub PoC★ 6
Chatwoot SQL injection in FilterService
Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values
41RISK
open ↗VulnCheck XDB
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open ↗GitHub PoC
kaleth4/CVE-2024-6387
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗GitHub PoC★ 1
CVE-2022-46364 Apache CXF XOP:Include SSRF / LFI
Apache CXF SSRF Vulnerability
48RISK
open ↗GitHub PoC
Apache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon kuralları ve IOC listesi.
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
open ↗GitHub PoC
CVE-2024-6387 OpenSSH 信号竞争漏洞（regreSSHion）分析报告及检测脚本
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open ↗Metasploit600
Supsystic Contact Form Wordpress Plugin SSTI RCE
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
75RISK
open ↗GitHub PoC
vettrivel007/CVE-2024-1086
Use-after-free in Linux kernel's netfilter: nf_tables component
76RISK
open ↗GitHub PoC
CVE-2022-22947 vulnerability task
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗GitHub PoC
JacobTaylor3/CVE-2021-21220
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to po
100RISK
open ↗GitHub PoC
PoC CVE-2025-54123 - Hoverfly <= 1.11.3 - Authenticated Middleware Command Injection
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISK
open ↗GitHub PoC
amikanev/CVE-2025-55182-LAB
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC★ 1
akelaqe/CVE-2024-27348-HugeGraph-RCE
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗GitHub PoC
Setup and exploit recreation for CVE-2022-42889 Text4Shell.
Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
60RISK
open ↗VulnCheck XDB
initial-access
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
CVE-2025-54123 exploit and documentation
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISK
open ↗GitHub PoC
0x0asif/CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗VulnCheck XDB
remote-with-credentials
Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation
68RISK
open ↗GitHub PoC★ 2
This vulnerability allows an attacker to perform SSRF (Server-Side Request Forgery) attacks on Apache CXF webservices that accept MTOM/XOP requests. The issue exists in how the href attribute of xop:Include is parsed, allowing arbitrary URLs to be requested by the server.
Apache CXF SSRF Vulnerability
48RISK
open ↗GitHub PoC★ 1
Shashivanth009/CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC
Apache CXF SSRF Vulnerability
48RISK
open ↗GitHub PoC★ 7
CVE-2022-46364-Poc Apache CXF SSRF via MTOM XOP:Include
Apache CXF SSRF Vulnerability
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.