Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
75,445cataloged exploits
34,432CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecentpopularrisk
13,627 exploits
GitHub PoC★ 7
CVE-2025-30208 - Vite Arbitrary File Read PoC
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC
Mongo Vulnub Lab...Try to Hack IT.....!
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
63RISK
open ↗GitHub PoC★ 9
WordPress Front End Users Plugin <= 3.2.32 is vulnerable to Arbitrary File Upload
Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload
53RISK
open ↗GitHub PoC
Next.js and the corrupt middleware...TRY TO HACK IT..!
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts.
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
corsisechero/CVE-2019-9193byVulHub
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
60RISK
open ↗GitHub PoC★ 1
mass scan for CVE-2025-30208
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC
A demo exploit for CVE-2021-44026, a SQL injection in Roundcube
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
90RISK
open ↗GitHub PoC
User Registration & Membership <= 4.1.2 - Authentication Bypass
User Registration & Membership < 4.1.3 - Authentication Bypass
41RISK
open ↗GitHub PoC★ 2
Detection of malicious VHD files for CVE-2025-24985
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
71RISK
open ↗GitHub PoC
DeividasTerechovas/SOC227-Microsoft-SharePoint-Server-Elevation-of-Privilege-Possible-CVE-2023-29357-Exploitation
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC
congdong007/CVE-2024-50623-poc
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file up
100RISK
open ↗GitHub PoC
Next.js CVE-2025-29927 güvenlik açığı hakkında
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
Authorization Bypass in Next.js Middleware
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 1
Next.js Middleware Bypass Vulnerability
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 1
SAPGateBreaker is a PoC exploit for CVE-2022-22536, a critical HTTP Request Smuggling vulnerability in SAP NetWeaver. It demonstrates how to bypass ACLs by desynchronizing request parsing between ICM and backend services using crafted Content-Length-based payloads.
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and
100RISK
open ↗GitHub PoC★ 6
Vite 任意文件读取漏洞POC
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
90RISK
open ↗GitHub PoC
B1gN0Se/Tomcat-CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC
mrrivaldo/CVE-2025-2294
Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
85RISK
open ↗GitHub PoC
Unauthenticated SQL injection exploit for CVE-2019-9053 in CMS Made Simple <= 2.2.9. Extracts admin creds with time-based SQLi.
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗GitHub PoC★ 13
Unauthenticated RCE exploit for CVE-2024-25600 in WordPress Bricks Builder <= 1.9.6. Executes arbitrary code remotely.
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗GitHub PoC
Script to make changes on registry to fix CVE-2013-3900. It comes with an option to undo in case it breaks something on your environment.
WinVerifyTrust Signature Validation Vulnerability
75RISK
open ↗GitHub PoC
backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 해킹
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_ac
100RISK
open ↗GitHub PoC★ 7
针对CVE-2025-30208和CVE-2025-31125的漏洞利用
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗GitHub PoC★ 5
Documentation and PoC for CVE-2023-21554 MSMQ Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
85RISK
open ↗GitHub PoC
thunww/CVE-2024-50379
Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
60RISK
open ↗GitHub PoC★ 1
A script that exploits SaltStack CVE-2020-11651 and CVE-2020-11652 to add new users to a vulnerable Salt master by injecting entries into /etc/passwd and /etc/shadow. POC
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.