Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,313cataloged exploits

34,834CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,797GitHub PoC 13,885VulnCheck XDB 8,484Nuclei 4,237Metasploit 3,467✓ verified onlyrecent popular risk

13,885 exploits

GitHub PoC★ 2

Log4jshell - CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware07 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

alexpena5635/CVE-2021-44228_scanner-main-Modified-

CVE-2021-44228CRITICALunder attackransomware05 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

Bassmaster Plugin NodeJS RCE

CVE-2014-7205—04 Jan 2022

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

60RISK

open ↗

GitHub PoC

Atmail XSS-CSRF-RCE Exploit Chain

CVE-2012-2593—04 Jan 2022

Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote atta

23RISK

open ↗

GitHub PoC

the name of virus is the detection of microsoft defender, is the tipic antivirus

CVE-2017-0147HIGHunder attackransomware04 Jan 2022

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows

100RISK

open ↗

GitHub PoC★ 9

darkpills/CVE-2021-25094-tatsu-preauth-rce

CVE-2021-25094—03 Jan 2022

Tatsu < 3.3.12 - Unauthenticated RCE

60RISK

open ↗

GitHub PoC

the name of virus is the detection of microsoft defender, is the tipic antivirus

CVE-2012-0158HIGHunder attack03 Jan 2022

The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls

100RISK

open ↗

GitHub PoC

Log4j2 LDAP 취약점 테스트 (CVE-2021-44228)

CVE-2021-44228CRITICALunder attackransomware03 Jan 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, known as log4shell.

CVE-2021-44228CRITICALunder attackransomware31 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 1

Presents how to exploit CVE-2021-44228 vulnerability.

CVE-2021-44228CRITICALunder attackransomware30 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 3

trganda/CVE-2021-22204

CVE-2021-22204MEDIUMunder attack29 Dec 2021

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISK

open ↗

GitHub PoC★ 4

Auerswald VoIP System Secret Backdoors -PoC

CVE-2021-40859—29 Dec 2021

Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web

60RISK

open ↗

GitHub PoC

d4rk30/CVE-2017-12943

CVE-2017-12943—29 Dec 2021

D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?RE

35RISK

open ↗

GitHub PoC★ 2

Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit

CVE-2021-40444HIGHunder attackransomware28 Dec 2021

Microsoft MSHTML Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 11

CVE-2019-9053 Exploit for Python 3

CVE-2019-9053—28 Dec 2021

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISK

open ↗

GitHub PoC

A spigot plugin to fix CVE-2021-44228 Log4j remote code execution vulnerability, to protect Minecraft clients.

CVE-2021-44228CRITICALunder attackransomware28 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

"Lavel Exploit CVE-2018-15133 is a powerful exploit that allows attackers to gain unauthorized access to vulnerable systems. This exploit was originally developed as part of a Capture The Flag (CTF) challenge and has since been used by security researchers and ethical hackers to identify and address vulnerabilities in web applications.

CVE-2018-15133HIGHunder attack28 Dec 2021

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

100RISK

open ↗

GitHub PoC★ 209

A tool for detect&exploit vmware product log4j(cve-2021-44228) vulnerability.Support VMware HCX/vCenter/NSX/Horizon/vRealize Operations Manager

CVE-2021-44228CRITICALunder attackransomware28 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 5

Auerswald COMpact 8.0B Backdoors exploit

CVE-2021-40859—28 Dec 2021

Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web

60RISK

open ↗

GitHub PoC

Quick and dirty scanner, hitting common ports looking for Log4Shell (CVE-2021-44228) vulnerability

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 4

log4j-paylaod generator : A generic payload generator for Apache log4j RCE CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

Ravid-CheckMarx/CVE-2021-44228-Apache-Log4j-Rce-main

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

IOCs for CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

Regra ModSec para proteção log4j2 - CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 2

Detection script for CVE-2021-42278 and CVE-2021-42287

CVE-2021-42278HIGHunder attackransomware27 Dec 2021

Active Directory Domain Services Elevation of Privilege Vulnerability

93RISK

open ↗

GitHub PoC

Log4Shell (Cve-2021-44228) Proof Of Concept

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

Log4Shell (CVE-2021-44228) is a zero-day vulnerability in Log4j

CVE-2021-44228CRITICALunder attackransomware27 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC

this repository contains a POC of CVE-2021-44228 (log4j2shell) as part of a security research

CVE-2021-44228CRITICALunder attackransomware25 Dec 2021

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 2

This is a basic ROP based exploit for CVE 2020-14871. CVE 2020-14871 is a vulnerability in Sun Solaris systems libpam library, and exploitable over ssh

CVE-2020-14871CRITICALunder attack25 Dec 2021

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve

100RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.