Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,652cataloged exploits

34,545CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,581GitHub PoC 13,708VulnCheck XDB 8,225Nuclei 4,228Metasploit 3,467✓ verified onlyrecent popular risk

13,708 exploits

GitHub PoC★ 1

This Python script automates the Proof of Concept (PoC) for CVE-2023-36845, a vulnerability impacting Juniper Networks Junos OS on EX and SRX Series devices. The vulnerability resides in the J-Web component, allowing remote manipulation of the PHPRC variable, potentially leading to code injection.

CVE-2023-36845CRITICALunder attack14 Feb 2024

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

GitHub PoC

CVE-2023-36845 и CVE-2023-36846 Juniper Junos OS J-Web RCE

CVE-2023-36845CRITICALunder attack13 Feb 2024

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

GitHub PoC★ 5

CVES

CVE-2023-36845CRITICALunder attack13 Feb 2024

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

100RISK

GitHub PoC

CVE-2024-23897

CVE-2024-23897CRITICALunder attackransomware13 Feb 2024

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

GitHub PoC

Explotación CVE-2017-1000486

CVE-2017-1000486CRITICALunder attack13 Feb 2024

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

100RISK

GitHub PoC★ 1

whoami-chmod777/CVE-2021-1675-CVE-2021-34527

CVE-2021-1675HIGHunder attackransomware12 Feb 2024

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

GitHub PoC

Lab introduction to ZeroLogon

CVE-2020-1472MEDIUMunder attackransomware12 Feb 2024

Netlogon Elevation of Privilege Vulnerability

100RISK

GitHub PoC

whoami-chmod777/CVE-2021-1675---PrintNightmare-LPE-PowerShell-

CVE-2021-1675HIGHunder attackransomware12 Feb 2024

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

GitHub PoC★ 2

vidura2/cve-2023-46747

CVE-2023-46747CRITICALunder attackransomware11 Feb 2024

BIG-IP Configuration utility unauthenticated remote code execution vulnerability

100RISK

GitHub PoC

quangnh89/CVE-2022-4262

CVE-2022-4262HIGHunder attack11 Feb 2024

Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corru

76RISK

GitHub PoC★ 76

CVE-2023-22527 内存马注入工具

CVE-2023-22527CRITICALunder attackransomware11 Feb 2024

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta

100RISK

GitHub PoC★ 1

CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept

CVE-2019-11447—11 Feb 2024

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

35RISK

GitHub PoC

arminarab1999/CVE-2018-9995

CVE-2018-9995—09 Feb 2024

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RISK

GitHub PoC

Yanoro/CVE-2017-11176

CVE-2017-11176—08 Feb 2024

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retr

23RISK

GitHub PoC

POC Badgermeter moni tool - CVE-2024-1301

CVE-2024-1301CRITICAL08 Feb 2024

Multiple Vulnerabilities in Badger Meter's Monitool

48RISK

GitHub PoC

joshbnewton31080/cve-2022-42889-text4shell

CVE-2022-42889—08 Feb 2024

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

60RISK

GitHub PoC

PoC to CVE-2023-30547 (Library vm2)

CVE-2023-30547CRITICAL08 Feb 2024

Sandbox Escape in vm2

70RISK

GitHub PoC

CVE-2017-0089 Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information

CVE-2017-0089—08 Feb 2024

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers

35RISK

GitHub PoC★ 3

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.

CVE-2024-23897CRITICALunder attackransomware07 Feb 2024

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

GitHub PoC

一款Spring综合漏洞的利用工具，工具目前支持Spring Cloud Gateway RCE(CVE-2022-22947)、Spring Framework RCE (CVE-2022-22965) 的检测以及利用

CVE-2022-22947CRITICALunder attack07 Feb 2024

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

100RISK

GitHub PoC★ 61

CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839

CVE-2023-21839HIGHunder attack06 Feb 2024

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t

100RISK

GitHub PoC★ 1

CVE-2023-6875 exploit written for Xakep.Ru

CVE-2023-6875CRITICAL05 Feb 2024

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

85RISK

GitHub PoC

xMr110/CVE-2022-1040

CVE-2022-1040CRITICALunder attack05 Feb 2024

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho

100RISK

GitHub PoC

trustcves/CVE-2024-24398

CVE-2024-24398CRITICAL05 Feb 2024

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker

48RISK

GitHub PoC

letsr00t/-2021-LOCALROOT-CVE-2021-22555

CVE-2021-22555HIGHunder attack05 Feb 2024

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISK

GitHub PoC

semcms存在SQL注入（CVE-2024-25422 ）

CVE-2024-25422CRITICAL04 Feb 2024

SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive info

48RISK

GitHub PoC★ 22

Nuclei template for CVE-2024-23897 (Jenkins LFI Vulnerability)

CVE-2024-23897CRITICALunder attackransomware04 Feb 2024

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

GitHub PoC

WLXQqwer/Jenkins-CVE-2024-23897-

CVE-2024-23897CRITICALunder attackransomware04 Feb 2024

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

GitHub PoC★ 5

Exploit for CVE-2019-2215 (bad binder) for Huawei P20 Lite

CVE-2019-2215HIGHunder attack04 Feb 2024

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

98RISK

GitHub PoC★ 1

GoAnywhere MFT

CVE-2024-0204CRITICAL04 Feb 2024

Authentication Bypass in GoAnywhere MFT

85RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.