Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,008cataloged exploits
34,638CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,443Referência 21,662GitHub PoC 13,743VulnCheck XDB 8,460Nuclei 4,233Metasploit 3,467✓ verified onlyrecentpopularrisk
13,743 exploits
GitHub PoC★ 4
PoC exploit for CVE-2022-36804 (BitBucket Critical Command Injection)
CVE-2022-36804HIGHunder attack23 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
GitHub PoC★ 3
WSO2 Arbitrary File Upload to Remote Command Execution (RCE)
CVE-2022-29464CRITICALunder attackransomware22 Sep 2022
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file
100RISK
open ↗
GitHub PoC
cobaltstrike4.5版本破/解、去除checksum8特征、bypass BeaconEye、修复错误路径泄漏stage、增加totp双因子验证、修复CVE-2022-39197等
CVE-2022-39197MEDIUMunder attack22 Sep 2022
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote att
75RISK
open ↗
GitHub PoC★ 3
PoC for exploiting CVE-2019-2729 on WebLogic
CVE-2019-2729CRITICAL22 Sep 2022
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte
85RISK
open ↗
GitHub PoC★ 73
cve-2022-39197 poc
CVE-2022-39197MEDIUMunder attack22 Sep 2022
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote att
75RISK
open ↗
GitHub PoC
For detection of sitecore RCE - CVE-2021-42237
CVE-2021-42237CRITICALunder attackransomware22 Sep 2022
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it
100RISK
open ↗
GitHub PoC★ 7
Bitbucket CVE-2022-36804 unauthenticated remote command execution
CVE-2022-36804HIGHunder attack21 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
GitHub PoC★ 1
CVE-2021-44228 POC / Example
CVE-2021-44228CRITICALunder attackransomware21 Sep 2022
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗
GitHub PoC
A Proof-Of-Concept for the CVE-2021-44228 vulnerability.
CVE-2021-44228CRITICALunder attackransomware21 Sep 2022
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗
GitHub PoC★ 2
MoCh3n/CVE-2015-5531-POC
CVE-2015-5531—21 Sep 2022
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
60RISK
open ↗
GitHub PoC★ 1
Caihuar/Joomla-cve-2015-8562
CVE-2015-8562—21 Sep 2022
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbi
60RISK
open ↗
GitHub PoC★ 3
CVE-2022-39197
CVE-2022-39197MEDIUMunder attack21 Sep 2022
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote att
75RISK
open ↗
GitHub PoC
dileepdkumar/LayarKacaSiber-CVE-2021-41773
CVE-2021-41773HIGHunder attackransomware20 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
GitHub PoC★ 82
Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.
CVE-2007-4559CRITICAL20 Sep 2022
Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows
53RISK
open ↗
GitHub PoC★ 3
CVE-2019-8943 WordPress Crop-Image
CVE-2019-8943—20 Sep 2022
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can
60RISK
open ↗
GitHub PoC
A critical vulnerability (CVE-2022-36804) in Atlassian Bitbucket Server and Data Center could be exploited by unauthorized attackers to execute malicious code on vulnerable instances.
CVE-2022-36804HIGHunder attack20 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
GitHub PoC★ 16
Somewhat Reliable PoC Exploit for CVE-2022-36804 (BitBucket Critical Command Injection)
CVE-2022-36804HIGHunder attack20 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
GitHub PoC★ 3
CVE-2022-36804 Atlassian Bitbucket Command Injection Vulnerability
CVE-2022-36804HIGHunder attack20 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
GitHub PoC★ 18
Multithreaded exploit script for CVE-2022-36804 affecting BitBucket versions <8.3.1
CVE-2022-36804HIGHunder attack19 Sep 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗
GitHub PoC★ 2
All Credit to MaherAzzouzi (https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit). This is a copy of the exploit for CTFs
CVE-2022-37706HIGH18 Sep 2022
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and th
56RISK
open ↗
GitHub PoC★ 4
CVE-2022-31814 Exploitation Toolkit.
CVE-2022-31814CRITICAL18 Sep 2022
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
85RISK
open ↗
GitHub PoC★ 4
CVE-2019-0708, A tool which mass hunts for bluekeep vulnerability for exploitation.
CVE-2019-0708CRITICALunder attackransomware17 Sep 2022
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗
GitHub PoC★ 1
touchmycrazyredhat/CVE-2022-27925-Revshell
CVE-2022-27925HIGHunder attackransomware17 Sep 2022
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file
100RISK
open ↗
GitHub PoC
cve-2010-2553复现
CVE-2010-2553—16 Sep 2022
The Cinepak codec in Microsoft Windows XP SP2 and SP3, Windows Vista SP1 and SP2, and Windows 7 does not properly decomp
35RISK
open ↗
GitHub PoC★ 1
pswalia2u/CVE-2020-7246
CVE-2020-7246—16 Sep 2022
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code
60RISK
open ↗
GitHub PoC★ 2
A proof of concept for CVE-2022-30190 (Follina).
CVE-2022-30190HIGHunder attackransomware15 Sep 2022
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC
mightysai1997/cve-2021-41773
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
GitHub PoC
mightysai1997/cve-2021-42013L
CVE-2021-42013CRITICALunder attackransomware15 Sep 2022
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
GitHub PoC
mightysai1997/cve-2021-42013.get
CVE-2021-42013CRITICALunder attackransomware15 Sep 2022
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
GitHub PoC★ 1
mightysai1997/CVE-2021-41773S
CVE-2021-41773HIGHunder attackransomware15 Sep 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
← previouspage 297 / 459next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.