Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
76,008 exploits
GitHub PoC★ 1
Apache CXF SSRF CVE-2024-28752
Apache CXF SSRF Vulnerability using the Aegis databinding
63RISK
open ↗GitHub PoC
Remote Code Execution (RCE) vulnerability in Apache Tomcat.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 2
WordPress PDF 2 Post Plugin <= 2.4.0 is vulnerable to Remote Code Execution (RCE) +Subscriber
WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability
53RISK
open ↗GitHub PoC
PoC for CVE-2017-5487 - WordPress User Enumeration via REST
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before
45RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗VulnCheck XDB
initial-access
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗VulnCheck XDB
initial-access
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC★ 3
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function
48RISK
open ↗GitHub PoC
SAP NetWeaver Visual Composer Metadata Uploader <= 7.50 CVE-2025-31324 PoC
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
congdong007/CVE-2025-29306_poc
An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.htm
75RISK
open ↗Exploit-DB
SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation
WordPress SureTriggers <= 1.0.82 - Privilege Escalation Vulnerability
75RISK
open ↗GitHub PoC
Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution (RCE)
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗Exploit-DB
WordPress Depicter Plugin 3.6.1 - SQL Injection
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
68RISK
open ↗Exploit-DB
Apache ActiveMQ 6.1.6 - Denial of Service (DOS)
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
33RISK
open ↗GitHub PoC★ 8
exploit for CVE-2025-27533, a Denial of Service (DoS) vulnerability in Apache ActiveMQ
Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation
33RISK
open ↗GitHub PoC
CVE-2024-38475 Scanner using FFUF + Seclists
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
100RISK
open ↗GitHub PoC★ 2
WordPress Frontend Login and Registration Blocks Plugin <= 1.0.7 is vulnerable to Privilege Escalation
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
63RISK
open ↗GitHub PoC
This is an exercise built around CVE-2021-3560
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile
91RISK
open ↗VulnCheck XDB
client-side
Kentico Xperience stored cross-site scripting in multiple-file upload functionality
60RISK
open ↗VulnCheck XDB
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗VulnCheck XDB
initial-access
Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover
63RISK
open ↗VulnCheck XDB
infoleak
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗VulnCheck XDB
initial-access
Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
60RISK
open ↗GitHub PoC
The Web Is Vulnerable to CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗Metasploit300
WordPress Depicter Plugin SQL Injection (CVE-2025-2011)
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
68RISK
open ↗GitHub PoC★ 1
sap-netweaver-cve-2025-31324-check
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
100RISK
open ↗GitHub PoC
x-middleware exploit for next.js CVE-2023–46298 cache poisoning and CVE-2025-29927 bypass
Authorization Bypass in Next.js Middleware
85RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.