Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
8,176 exploits
VulnCheck XDB
infoleak
CVE-2024-51378CRITICALunder attackransomware03 Jan 2025
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware03 Jan 2025
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-53677CRITICAL03 Jan 2025
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
70RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-50498CRITICAL03 Jan 2025
WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability
75RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-51409CRITICAL03 Jan 2025
WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
75RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-38856HIGHunder attack02 Jan 2025
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2024-10400HIGH02 Jan 2025
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
78RISK
open ↗
VulnCheck XDB
infoleak
CVE-2024-23897CRITICALunder attackransomware02 Jan 2025
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-9805HIGHunder attack02 Jan 2025
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-9593HIGH01 Jan 2025
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
61RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-50623CRITICALunder attackransomware31 Dec 2024
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗
VulnCheck XDB
local
CVE-2023-38831HIGHunder attackransomware30 Dec 2024
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware30 Dec 2024
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
local
CVE-2023-21768HIGH30 Dec 2024
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-21182HIGHunder attack29 Dec 2024
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
83RISK
open ↗
VulnCheck XDB
initial-access
CVE-2019-0232—29 Dec 2024
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-21182HIGHunder attack29 Dec 2024
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t
83RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-7954CRITICAL28 Dec 2024
SPIP porte_plume Plugin Arbitrary PHP Execution
85RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-9234CRITICAL28 Dec 2024
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
68RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2021-22911—26 Dec 2024
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2020-14882CRITICALunder attack26 Dec 2024
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2024-9047CRITICAL25 Dec 2024
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
85RISK
open ↗
VulnCheck XDB
infoleak
CVE-2024-23334MEDIUM25 Dec 2024
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
70RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-9206—24 Dec 2024
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-10914CRITICAL24 Dec 2024
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
85RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-32113CRITICALunder attack24 Dec 2024
Apache OFBiz: Path traversal leading to RCE
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2024-12209CRITICAL24 Dec 2024
WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
68RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-50623CRITICALunder attackransomware23 Dec 2024
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2024-56145CRITICALunder attack22 Dec 2024
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
100RISK
open ↗
VulnCheck XDB
local
CVE-2024-26229HIGH22 Dec 2024
Windows CSC Service Elevation of Privilege Vulnerability
41RISK
open ↗
← previouspage 102 / 273next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.