Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
76,107 exploits
Exploit-DB
CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS)
CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting
33RISK
open ↗VulnCheck XDB
initial-access
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
56RISK
open ↗Exploit-DB
Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth
85RISK
open ↗Exploit-DB
Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or
41RISK
open ↗VulnCheck XDB
denial-of-service
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗GitHub PoC
OD&H's scanner for CVE-2024-25600 vulnerability in the Bricks Builder WordPress plugin. For use in Try Hack Me (THM) environments.
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗Exploit-DB
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗VulnCheck XDB
initial-access
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗Exploit-DB
Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the
48RISK
open ↗Exploit-DB
ResidenceCMS 2.10.1 - Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to crea
33RISK
open ↗GitHub PoC
Research on Next.js middleware vulnerability (CVE-2025-29927) allowing authorization bypass and potential exploits.
Authorization Bypass in Next.js Middleware
85RISK
open ↗Exploit-DB
Zohocorp ManageEngine ADManager Plus 7210 - Elevation of Privilege
Privilege Escalation
41RISK
open ↗Metasploit600
BentoML's runner server RCE
Insecure Deserialization leads to RCE in BentoML's runner server
75RISK
open ↗Metasploit600
Langflow AI RCE
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISK
open ↗Exploit-DB
PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF)
pz-frontend-manager < 1.0.6 - CSRF change user profile picture
41RISK
open ↗Exploit-DB
Artica Proxy 4.50 - Remote Code Execution (RCE)
Artica Proxy Unauthenticated PHP Deserialization Vulnerability
85RISK
open ↗GitHub PoC★ 2
a lightweight JavaScript snippet showcasing how unauthorized password changes can be triggered on vulnerable Fortinet FortiSwitch GUI endpoints.
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to c
53RISK
open ↗GitHub PoC★ 1
A simple, easy-to-use POC for CVE-2025-42813 (Apache Tomcat versions below 9.0.99).
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 73
PoC for CVE-2025-22457 - A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISK
open ↗VulnCheck XDB
initial-access
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISK
open ↗Exploit-DB✓ VexDay Proof
DocsGPT 0.12.0 - Remote Code Execution
Remote Code Execution in DocsGPT
68RISK
open ↗VulnCheck XDB
initial-access
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
100RISK
open ↗Exploit-DB
jQuery 3.3.1 - Prototype Pollution & XSS Exploit
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
45RISK
open ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.