Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
71,957cataloged exploits
32,195CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,003GitHub PoC 13,307VulnCheck XDB 8,182Nuclei 4,217Metasploit 3,462✓ verified onlyrecentpopularrisk
71,886 exploits
GitHub PoC★ 19
Dahua IP camera CVE research toolkit (CVE-2021-33044/33045, CVE-2025-31700/31701)
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RISK
open ↗GitHub PoC
CVE-2024-23897: Jenkins Arbitrary File Read Lead to RCE
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗Exploit-DB
mailcow 2025-01a - Host Header Password Reset Poisoning
mailcow: dockerized vulnerable to password reset poisoning
41RISK
open ↗VulnCheck XDB
initial-access
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
48RISK
open ↗VulnCheck XDB
remote-with-credentials
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
78RISK
open ↗VulnCheck XDB
initial-access
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RISK
open ↗VulnCheck XDB
initial-access
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment
100RISK
open ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗VulnCheck XDB
client-side
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RISK
open ↗GitHub PoC★ 9
gowonisgood/CVE-2025-62215-POC
Windows Kernel Elevation of Privilege Vulnerability
71RISK
open ↗VulnCheck XDB
initial-access
MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection
33RISK
open ↗VulnCheck XDB
remote-with-credentials
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vul
90RISK
open ↗VulnCheck XDB
initial-access
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
75RISK
open ↗GitHub PoC
PoC of CVE-2021-4034 (PwnKit) for personal training purposes.
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC
Metasploit module to exploit CVE-2024-46987 - an authenticated path traversal vulnerability in Camaleon CMS versions 2.8.0 through 2.8.2 and 2.9.0
Arbitrary path traversal in Camaleon CMS
61RISK
open ↗GitHub PoC
Aryan20057/CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
100RISK
open ↗GitHub PoC
CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
100RISK
open ↗GitHub PoC★ 1
CVE-2025-43529 Test
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and
71RISK
open ↗GitHub PoC
CVE-2014-0160
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
100RISK
open ↗GitHub PoC
CVE-2022-22965
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗Metasploit600
FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass
FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
36RISK
open ↗Metasploit600
FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass
FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
55RISK
open ↗GitHub PoC
Laravel-RCE: CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISK
open ↗VulnCheck XDB
local
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗VulnCheck XDB
denial-of-service
Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside
76RISK
open ↗GitHub PoC
Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.