Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,107cataloged exploits
34,679CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,692GitHub PoC 13,812VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
76,107 exploits
VulnCheck XDB
initial-access
SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
85RISK
open ↗VulnCheck XDB
initial-access
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
100RISK
open ↗Exploit-DB
CodeCanyon RISE CRM 3.7.0 - SQL Injection
CodeCanyon RISE Ultimate Project Manager save sql injection
38RISK
open ↗Exploit-DB
Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass
Registration Authentication Bypass Vulnerability
100RISK
open ↗GitHub PoC★ 12
PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
100RISK
open ↗GitHub PoC★ 3
Create lab for CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 92
NextSploit is a command-line tool designed to detect and exploit CVE-2025-29927, a security flaw in Next.js
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
brandonhjh/Jenkins-CVE-2024-23897-Exploit-Demo
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an
100RISK
open ↗GitHub PoC★ 3
CVE-2025-29927: Next.js Middleware Exploit
Authorization Bypass in Next.js Middleware
85RISK
open ↗Exploit-DB
Sonatype Nexus Repository 3.53.0-01 - Path Traversal
Nexus Repository 3 - Path Traversal
61RISK
open ↗GitHub PoC
N3xtGenH4cker/CVE-2020-0618_DETECTION
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page
100RISK
open ↗GitHub PoC
This repository is for educational and research purposes.
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 1
POC IngressNightmare (CVE-2025-1974), modified from https://github.com/yoshino-s/CVE-2025-1974
ingress-nginx admission controller RCE escalation
85RISK
open ↗Exploit-DB
Litespeed Cache 6.5.0.1 - Authentication Bypass
WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability
85RISK
open ↗Exploit-DB
Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗GitHub PoC★ 1
CVE-2025-30208 ViteVulnScanner
Vite bypasses server.fs.deny when using `?raw??`
70RISK
open ↗VulnCheck XDB
initial-access
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
100RISK
open ↗VulnCheck XDB
denial-of-service
Synapse vulnerable to federation denial of service via malformed events
41RISK
open ↗GitHub PoC
A Deliberately Vulnerable Web Application built on Struts 2 (CVE-2017-5638) and Log4J (CVE-2021-44228) for testing and demonstration of OWASP Top 10 Web Application Security Risks: A06:2021-Vulnerable and Outdated Components.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
100RISK
open ↗GitHub PoC
Este script verifica la vulnerabilidad CVE-2025-29927 en servidores Next.js, probando múltiples cargas en la cabecera x-middleware-subrequest para detectar accesos no autorizados.
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC★ 1
rubbxalc/CVE-2025-24071
Microsoft Windows File Explorer Spoofing Vulnerability
38RISK
open ↗Exploit-DB
MoziloCMS 3.0 - Remote Code Execution (RCE)
An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute a
46RISK
open ↗GitHub PoC
A minimal test tool to help detect annotation injection vulnerabilities in Kubernetes NGINX Ingress controllers. This script sends a crafted AdmissionReview request to simulate a potential exploit path from CVE-2025-1974 and checks for signs of misinterpreted annotations in controller logs.
ingress-nginx admission controller RCE escalation
85RISK
open ↗GitHub PoC
IngressNightmare (CVE-2025-1974)
ingress-nginx admission controller RCE escalation
85RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.