Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,526cataloged exploits

34,478CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,534GitHub PoC 13,654VulnCheck XDB 8,213Nuclei 4,218Metasploit 3,464✓ verified onlyrecent popular risk

13,654 exploits

GitHub PoC

In December 2021, the world of cybersecurity was shaken by the discovery of the Log4Shell vulnerability (CVE-2021-44228), embedded within the widely-used Apache Log4j library. With a CVSS score of 10

CVE-2021-44228CRITICALunder attackransomware10 Nov 2024

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation

CVE-2024-10586CRITICAL10 Nov 2024

Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation

48RISK

GitHub PoC

To test elasticsearch vulnerabillity on newer version of debian

CVE-2015-1427CRITICALunder attack10 Nov 2024

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s

100RISK

GitHub PoC★ 3

WP Sessions Time Monitoring Full Automatic <= 1.0.9 - Unauthenticated SQL Injection

CVE-2024-49681CRITICAL09 Nov 2024

WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerability

48RISK

GitHub PoC★ 14

Exploit for cve-2024-10914: D-Link DNS-320, DNS-320LW, DNS-325, DNS-340L Version 1.00, Version 1.01.0914.2012, Version 1.01, Version 1.02, Version 1.08 Command Injection

CVE-2024-10914CRITICAL09 Nov 2024

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

85RISK

GitHub PoC

WP Dropbox Dropins <= 1.0 - Unauthenticated Arbitrary File Upload

CVE-2024-49607CRITICAL09 Nov 2024

WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

48RISK

GitHub PoC

sea-middle/cve-2023-25813

CVE-2023-25813CRITICAL09 Nov 2024

SQL Injection via replacements in sequelize

48RISK

GitHub PoC★ 1

Proof of concept of the parh traversal in python AioHTTP library =< 3.9.1

CVE-2024-23334MEDIUM09 Nov 2024

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RISK

GitHub PoC

Ajar in5 Embed <= 3.1.3 - Unauthenticated Arbitrary File Upload

CVE-2024-50473CRITICAL09 Nov 2024

WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

48RISK

GitHub PoC

SurveyJS: Drag & Drop WordPress Form Builder <= 1.9.136 - Authenticated (Subscriber+) Arbitrary File Upload

CVE-2024-50427CRITICAL08 Nov 2024

WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

48RISK

GitHub PoC

CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation

CVE-2024-4898CRITICAL08 Nov 2024

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation

63RISK

GitHub PoC

WPLMS Learning Management System for WordPress <= 4.962 – Unauthenticated Arbitrary File Read and Deletion

CVE-2024-10470CRITICAL08 Nov 2024

WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

60RISK

GitHub PoC

Stacks Mobile App Builder <= 5.2.3 - Authentication Bypass via Account Takeover

CVE-2024-50477CRITICAL08 Nov 2024

WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

63RISK

GitHub PoC

Exploit Development for CVE-2023-6553 on Backup Plugin in Wordpress

CVE-2023-6553CRITICAL07 Nov 2024

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

85RISK

GitHub PoC★ 98

Fortinet Fortimanager Unauthenticated Remote Code Execution AKA FortiJump CVE-2024-47575

CVE-2024-47575CRITICALunder attack07 Nov 2024

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2

100RISK

GitHub PoC★ 1

cbyerpanel rce exploit

CVE-2024-51567CRITICALunder attackransomware07 Nov 2024

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypas

100RISK

GitHub PoC

CVE-2023-25813 Vulnerability Reproduction - SQL Injection in Sequelize

CVE-2023-25813CRITICAL07 Nov 2024

SQL Injection via replacements in sequelize

48RISK

GitHub PoC★ 1

AliHj98/cve-2024-38063-Anonyvader

CVE-2024-38063CRITICAL07 Nov 2024

Windows TCP/IP Remote Code Execution Vulnerability

70RISK

GitHub PoC★ 1

0xR00/CVE-2024-23334

CVE-2024-23334MEDIUM07 Nov 2024

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RISK

GitHub PoC★ 6

WP REST API FNS <= 1.0.0 - Privilege Escalation

CVE-2024-49328CRITICAL06 Nov 2024

WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability

48RISK

GitHub PoC

pbj2647/CVE-2023-25813

CVE-2023-25813CRITICAL06 Nov 2024

SQL Injection via replacements in sequelize

48RISK

GitHub PoC★ 25

CVE-2024-4577 RCE PoC

CVE-2024-4577CRITICALunder attackransomware06 Nov 2024

Argument Injection in PHP-CGI

100RISK

GitHub PoC

pedrochalegre7/CVE-2024-4367-pdf-sample

CVE-2024-4367MEDIUM06 Nov 2024

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c

55RISK

GitHub PoC

Woocommerce Product Design <= 1.0.0 - Unauthenticated Arbitrary File Upload

CVE-2024-50482CRITICAL05 Nov 2024

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

48RISK

GitHub PoC

guigui237/Expoitation-de-la-vuln-rabilit-CVE-2022-22965

CVE-2022-22965CRITICALunder attack05 Nov 2024

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

GitHub PoC

WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check

CVE-2024-9933CRITICAL05 Nov 2024

WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check

48RISK

GitHub PoC★ 4

This repository contains a Crystallographic Information File (CIF) intended for use on the "Chemistry" machine on Hack The Box (HTB).

CVE-2024-23346CRITICAL05 Nov 2024

pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

48RISK

GitHub PoC★ 3

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

CVE-2024-9932CRITICAL05 Nov 2024

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

60RISK

GitHub PoC

1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover

CVE-2024-50478CRITICAL05 Nov 2024

WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability

48RISK

GitHub PoC★ 2

Meetup <= 0.1 - Authentication Bypass via Account Takeover

CVE-2024-50483CRITICAL05 Nov 2024

WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability

48RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.