Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,445cataloged exploits

34,432CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,497GitHub PoC 13,627VulnCheck XDB 8,198Nuclei 4,217Metasploit 3,463✓ verified onlyrecent popular risk

13,627 exploits

GitHub PoC

CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware12 Mar 2025

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 7

tinashelorenzi/CVE-2023-30258-magnus-billing-v7-exploit

CVE-2023-30258CRITICAL12 Mar 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RISK

open ↗

GitHub PoC★ 1

MS17-010 (CVE-2017-0143) - Python3 Script

CVE-2017-0143HIGHunder attackransomware12 Mar 2025

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

open ↗

GitHub PoC

CVE-2017-11882 Preventer for .docx files

CVE-2017-11882HIGHunder attackransomware11 Mar 2025

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

open ↗

GitHub PoC

CVE-2024-8289 https://www.cve.org/CVERecord?id=CVE-2024-8289, Vendor wcmp Product MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution

CVE-2024-8289CRITICAL11 Mar 2025

MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover

48RISK

open ↗

GitHub PoC

In this project, I documented a detailed penetration testing process targeting Apache HTTP Server vulnerabilities, specifically CVE-2021-41773 and CVE-2021-42013, which involve Path Traversal and Remote Code Execution (RCE).

CVE-2021-41773HIGHunder attackransomware11 Mar 2025

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

open ↗

GitHub PoC

CVE-2024-54383, https://www.cve.org/CVERecord?id=CVE-2024-54383

CVE-2024-54383CRITICAL11 Mar 2025

WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability

48RISK

open ↗

GitHub PoC

CVE-2024-10924 - Authentication Bypass in ReallySimpleSSL Wordpress Plugin

CVE-2024-10924CRITICAL11 Mar 2025

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

85RISK

open ↗

GitHub PoC

KQL para deteccion de CVE-2025-21333 en Sentinel

CVE-2025-21333HIGHunder attack11 Mar 2025

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

71RISK

open ↗

GitHub PoC

Remote code execution running on w3 total cache cve 2013-2010

CVE-2013-2010—11 Mar 2025

WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

60RISK

open ↗

GitHub PoC

Sp4ceDogy/NPE-CS-V-CVE-2021-1675

CVE-2021-1675HIGHunder attackransomware10 Mar 2025

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC

Sornphut/CVE-2021-3156-Heap-Based-Buffer-Overflow-in-Sudo-Baron-Samedit-

CVE-2021-3156HIGHunder attack10 Mar 2025

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC★ 15

Exploit for CVE-2024-0402 in Gitlab

CVE-2024-0402CRITICAL10 Mar 2025

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

48RISK

open ↗

GitHub PoC★ 3

Ivanti Remote code execution

CVE-2025-0282CRITICALunder attackransomware10 Mar 2025

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7

100RISK

open ↗

GitHub PoC

sk00l/CVE-2023-30258

CVE-2023-30258CRITICAL09 Mar 2025

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary com

85RISK

open ↗

GitHub PoC★ 4

Unauthenticated remote command execution in Papercut service allows an attacker to execute commands due to improper access controls in the SetupCompleted Java class.

CVE-2023-27350CRITICALunder attackransomware09 Mar 2025

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bui

100RISK

open ↗

GitHub PoC

cve-2017-5487 wp rest api 취약점

CVE-2017-5487—08 Mar 2025

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before

45RISK

open ↗

GitHub PoC

progress moveit cve-2024-5806

CVE-2024-5806CRITICAL08 Mar 2025

MOVEit Transfer Authentication Bypass Vulnerability

85RISK

open ↗

GitHub PoC

elphon/CVE-2007-2447-Exploit

CVE-2007-2447—08 Mar 2025

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands

50RISK

open ↗

GitHub PoC

Zimbra CVE-2024-45519

CVE-2024-45519CRITICALunder attack08 Mar 2025

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9,

100RISK

open ↗

GitHub PoC

Simulation of the Zerologon (CVE-2020-1472) vulnerability attack in Active Directory on Windows Server 2016 and the use of the Trend Micro Deep Security solution to prevent such attacks.

CVE-2020-1472MEDIUMunder attackransomware07 Mar 2025

Netlogon Elevation of Privilege Vulnerability

100RISK

open ↗

GitHub PoC

CVE-2023-40028 is a security vulnerability affecting Ghost CMS versions prior to 5.59.1.

CVE-2023-40028MEDIUM07 Mar 2025

Arbitrary file read via symlinks in Ghost

45RISK

open ↗

GitHub PoC★ 4

Python3 Rewrite of SmarterMail < Build 6985 Remote Code Execution found by 1F98D (CVE-2019-7214) POC

CVE-2019-7214—07 Mar 2025

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker co

60RISK

open ↗

GitHub PoC★ 1

A Critical Windows OLE Zero-Click Vulnerability. This is a proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability (CVSS 9.8). This is a memory corruption PoC

CVE-2025-21298CRITICAL07 Mar 2025

Windows OLE Remote Code Execution Vulnerability

70RISK

open ↗

GitHub PoC

This repository contains a PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. By crafting repositories with submodules in a specific way, an attacker can exploit symlink handling on case-insensitive filesystems to write files into the .git/ directory, leading to the execution of malicious hooks.

CVE-2024-32002CRITICAL06 Mar 2025

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RISK

open ↗

GitHub PoC★ 2

Arbitrary file read in Grafana allows an attacker to read server files by abusing a path traversal.

CVE-2021-43798HIGHunder attack06 Mar 2025

Grafana path traversal

100RISK

open ↗

GitHub PoC

CVE-2024-32002CRITICAL06 Mar 2025

Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

53RISK

open ↗

GitHub PoC

HFS 2.3m SERVER RCE Vulnerability exploit

CVE-2024-23692CRITICALunder attack06 Mar 2025

Rejetto HTTP File Server 2.3m Unauthenticated RCE

100RISK

open ↗

GitHub PoC★ 2

Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

CVE-2025-1307CRITICAL05 Mar 2025

Newscrunch <= 1.8.4 - Authenticated (Subscriber+) Arbitrary File Upload

48RISK

open ↗

GitHub PoC

GazettEl/CVE-2020-24186

CVE-2020-24186CRITICAL05 Mar 2025

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

85RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.