Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

75,902cataloged exploits

34,597CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,624GitHub PoC 13,727VulnCheck XDB 8,410Nuclei 4,231Metasploit 3,467✓ verified onlyrecent popular risk

13,727 exploits

GitHub PoC★ 84

CVE-2023-32243 - Essential Addons for Elementor 5.4.0-5.7.1 - Unauthenticated Privilege Escalation

CVE-2023-32243CRITICAL15 May 2023

WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

85RISK

open ↗

GitHub PoC★ 8

Abusing CVE-2023-28206 to make something useful

CVE-2023-28206HIGHunder attack15 May 2023

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5,

76RISK

open ↗

GitHub PoC

school project

CVE-2019-15107CRITICALunder attackransomware15 May 2023

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

open ↗

GitHub PoC★ 12

Follina (CVE-2022-30190) is a Microsoft Office zero-day vulnerability that has recently been discovered. It’s a high-severity vulnerability that hackers can leverage for remote code execution (RCE) attacks.

CVE-2022-30190HIGHunder attackransomware14 May 2023

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 3

Exploit for CVE-2023-32243 - Unauthorized Account Takeover.

CVE-2023-32243CRITICAL14 May 2023

WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

85RISK

open ↗

GitHub PoC★ 4

Akash7350/CVE-2021-22204

CVE-2021-22204MEDIUMunder attack14 May 2023

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISK

open ↗

GitHub PoC★ 6

Exploits for Tenda Ac8v4 stack-based overflow to Remote-Code Execution via Mipsel Ropping (CVE-2023-33669 - CVE-2023-33675)

CVE-2023-33669CRITICAL13 May 2023

Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c funct

48RISK

open ↗

GitHub PoC★ 1

poc

CVE-2023-32243CRITICAL13 May 2023

WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

85RISK

open ↗

GitHub PoC★ 7

Exploit for Ubuntu 20.04 using CVE-2021-3156 enhanced with post-exploitation scripts

CVE-2021-3156HIGHunder attack13 May 2023

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC

raiden757/CVE-2020-17087

CVE-2020-17087HIGHunder attack13 May 2023

Windows Kernel Local Elevation of Privilege Vulnerability

71RISK

open ↗

GitHub PoC★ 3

R0rt1z2/CVE-2022-38181

CVE-2022-38181HIGHunder attack12 May 2023

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishan

76RISK

open ↗

GitHub PoC

A simple PoC for CVE-2022-46169 a.k.a Cacti Unauthenticated Command Injection, a vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti prior from version 1.2.17 to 1.2.22

CVE-2022-46169CRITICALunder attack12 May 2023

Unauthenticated Command Injection

100RISK

open ↗

GitHub PoC★ 1

Exploit for grafana CVE-2021-43798

CVE-2021-43798HIGHunder attack12 May 2023

Grafana path traversal

100RISK

open ↗

GitHub PoC

Baron SameEdit Heap Overflow LPE 1-Day Exploit

CVE-2021-3156HIGHunder attack11 May 2023

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

open ↗

GitHub PoC★ 4

redis未授权、redis_CVE-2022-0543检测利用二合一脚本

CVE-2022-0543CRITICALunder attack10 May 2023

It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific

100RISK

open ↗

GitHub PoC

Ejecución de exploit de deserialización con CVE-2017-5941

CVE-2017-5941—10 May 2023

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Untrusted data passed into the unserialize() fu

35RISK

open ↗

GitHub PoC

Ejecución de exploit de deserialización con CVE-2017-5941

CVE-2018-15133HIGHunder attack10 May 2023

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

100RISK

open ↗

GitHub PoC

0xSalle/cve-2018-15133

CVE-2018-15133HIGHunder attack10 May 2023

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

100RISK

open ↗

GitHub PoC

A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10

CVE-2017-5638CRITICALunder attackransomware10 May 2023

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha

100RISK

open ↗

GitHub PoC★ 1

Script of Network Security Project - Attack on CVE-2021-22555

CVE-2021-22555HIGHunder attack10 May 2023

Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE

100RISK

open ↗

GitHub PoC★ 3

A PoC exploit for CVE-2008-5862 - Directory traversal vulnerability in webcamXP 5.3.2.375 and 5.3.2.410

CVE-2008-5862—10 May 2023

Directory traversal vulnerability in webcamXP 5.3.2.375 and 5.3.2.410 build 2132 allows remote attackers to read arbitra

23RISK

open ↗

GitHub PoC★ 4

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

CVE-2011-2523—09 May 2023

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

60RISK

open ↗

GitHub PoC★ 4

CVE-2023-0386 EXP

CVE-2023-0386HIGHunder attack08 May 2023

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RISK

open ↗

GitHub PoC★ 2

WordPress Plugin Gwolle Guestbook 1.5.3 - Remote File Inclusion

CVE-2015-8351—08 May 2023

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_includ

35RISK

open ↗

GitHub PoC★ 10

A PoC exploit for CVE-2019-15107 - Webmin Remote Code Execution

CVE-2019-15107CRITICALunder attackransomware08 May 2023

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

100RISK

open ↗

GitHub PoC★ 11

Apache Superset Auth Bypass (CVE-2023-27524)

CVE-2023-27524HIGHunder attack08 May 2023

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

100RISK

open ↗

GitHub PoC

An exploit script for CVE-2022-28368 designed to make exploitation less annoying, made for a HTB machine

CVE-2022-28368—07 May 2023

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (

60RISK

open ↗

GitHub PoC★ 7

CVE-2023-23397 PoC

CVE-2023-23397CRITICALunder attack07 May 2023

Microsoft Outlook Elevation of Privilege Vulnerability

100RISK

open ↗

GitHub PoC★ 124

CVE-2023-0386 analysis and Exp

CVE-2023-0386HIGHunder attack06 May 2023

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities wa

86RISK

open ↗

GitHub PoC★ 9

A PoC exploit for CVE-2017-5487 - WordPress User Enumeration.

CVE-2017-5487—06 May 2023

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before

45RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.