Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
72,018cataloged exploits
32,219CVEs with public exploitation
1,932lab-tested
AllExploit-DB 22,786Referência 20,023GitHub PoC 13,334VulnCheck XDB 8,195Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
13,334 exploits
GitHub PoC★ 2
本脚本是针对 GeoServer 的远程代码执行漏洞（CVE-2024-36401）开发的 PoC（Proof of Concept）探测工具。该漏洞允许攻击者通过构造特定请求，在目标服务器上执行任意命令。
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISK
open ↗GitHub PoC★ 20
A tool designed to detect the vulnerability **CVE-2025-31650** in Apache Tomcat (versions 10.1.10 to 10.1.39)
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
53RISK
open ↗GitHub PoC
This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running Erlang-based SSH servers
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC
CVE-2021-42287/CVE-2021-42278/OTHER Scanner & Exploiter.
Active Directory Domain Services Elevation of Privilege Vulnerability
93RISK
open ↗GitHub PoC★ 1
Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
This script is a custom security tool designed to test for a critical pre-authentication vulnerability in systems running Erlang-based SSH servers
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC
dev0558/CVE-2023-32243-Detection-and-Mitigation-in-WordPress
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
85RISK
open ↗GitHub PoC
Detection, analysis, and response strategies for CVE-2024-3400 exploitation attempts targeting Palo Alto PAN-OS GlobalProtect portals. Includes IOCs, exploit patterns, and mitigation guidance.
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
100RISK
open ↗GitHub PoC
TPLink VN020-F3v Denial of Service (CVE-2024-12342)
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
41RISK
open ↗GitHub PoC★ 5
This is a CVE-2025-29927 Scanner.
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 2
SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. T
85RISK
open ↗GitHub PoC★ 1
CVE-2025-32433 is a vuln of ssh
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗GitHub PoC★ 4
Exploit para Poultry Farm Management System v1.0
Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability
48RISK
open ↗GitHub PoC
SAP PoC para CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC★ 1
Nuclei template for cve-2025-31324 (SAP)
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
SAP NetWeaver Unauthenticated Remote Code Execution
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC★ 6
Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
shun1403/PIL-CVE-2017-8291-study
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion
100RISK
open ↗GitHub PoC★ 1
yeahhbean/Laravel-CVE-2018-15133
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri
100RISK
open ↗GitHub PoC★ 2
CVE-2022-3552 RCE with detailed exploitation steps
Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling
53RISK
open ↗GitHub PoC★ 24
CVE-2025-31324, SAP Exploit
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC★ 12
Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC★ 25
This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution (RCE) vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation feature of CraftCMS.
Craft CMS Allows Remote Code Execution
100RISK
open ↗GitHub PoC
airtiels 5650 CVE-2015-2797 PoC
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 502
60RISK
open ↗GitHub PoC
Attacks a vulnerable WordPress site with the wp-automatic plugin. Inserts a new user called eviladmin directly into the database (INSERT INTO wp_users). Searches for the ID of the newly created user (cyclic SELECT). Promotes eviladmin to Administrator (INSERT INTO wp_usermeta).
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
85RISK
open ↗GitHub PoC
shun1403/CVE-2017-8291
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion
100RISK
open ↗GitHub PoC
CVE-2025-32433 Summary and Attack Overview
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.