Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

76,496cataloged exploits

34,964CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,443Referência 21,899GitHub PoC 13,937VulnCheck XDB 8,510Nuclei 4,239Metasploit 3,468✓ verified onlyrecent popular risk

13,885 exploits

GitHub PoC★ 270

A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.

CVE-2021-43798HIGHunder attack07 Dec 2021

Grafana path traversal

100RISK

GitHub PoC★ 12

Grafanav8.*版本任意文件读取漏洞批量检测工具：该漏洞目前为0day漏洞，未授权的攻击者利用该漏洞，能够获取服务器敏感文件。

CVE-2021-43798HIGHunder attack07 Dec 2021

Grafana path traversal

100RISK

GitHub PoC★ 14

CVE-2021-43798 Grafana 任意文件读取漏洞 POC+参数

CVE-2021-43798HIGHunder attack07 Dec 2021

Grafana path traversal

100RISK

GitHub PoC★ 369

Grafana Unauthorized arbitrary file reading vulnerability

CVE-2021-43798HIGHunder attack07 Dec 2021

Grafana path traversal

100RISK

GitHub PoC★ 24

CVE-2021-43798:Grafana 任意文件读取漏洞

CVE-2021-43798HIGHunder attack07 Dec 2021

Grafana path traversal

100RISK

GitHub PoC★ 27

Grafana Arbitrary File Reading Vulnerability

CVE-2021-43798HIGHunder attack07 Dec 2021

Grafana path traversal

100RISK

GitHub PoC

reverse shell execution exploit of CVE 22204

CVE-2021-22204MEDIUMunder attack06 Dec 2021

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISK

GitHub PoC★ 41

CVE-2021-43798 - Grafana 8.x Path Traversal (Pre-Auth)

CVE-2021-43798HIGHunder attack06 Dec 2021

Grafana path traversal

100RISK

GitHub PoC★ 9

zer0yu/CVE-2021-41277

CVE-2021-41277CRITICALunder attack06 Dec 2021

GeoJSON URL validation can expose server files and environment variables to unauthorized users

100RISK

GitHub PoC★ 18

CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)

CVE-2021-1675HIGHunder attackransomware05 Dec 2021

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

GitHub PoC★ 8

Microsoft Exchange ProxyLogon PoC (CVE-2021-26855)

CVE-2021-26855CRITICALunder attackransomware04 Dec 2021

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

GitHub PoC

MaximeSchlegel/CVE-2021-32724-Target

CVE-2021-32724CRITICAL03 Dec 2021

check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack

48RISK

GitHub PoC

sinisterghost/https-github.com-iBearcat-CVE-2018-8174_EXP

CVE-2018-8174HIGHunder attackransomware03 Dec 2021

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows

93RISK

GitHub PoC★ 1

a python3 version of the exploit written for CVE-2014-6287. Useful for completing the "Steel Mountain" room on TryHackMe.com without the use of metasploit.

CVE-2014-6287CRITICALunder attack03 Dec 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

GitHub PoC

A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287

CVE-2014-6287CRITICALunder attack02 Dec 2021

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

GitHub PoC★ 1

CVE-2021-42325 POC

CVE-2021-42325—02 Dec 2021

Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

28RISK

GitHub PoC

dearpan/cve-2018-9995

CVE-2018-9995—02 Dec 2021

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR L

60RISK

GitHub PoC★ 3

CVE-2021-43778 poc

CVE-2021-43778CRITICAL30 Nov 2021

Path traversal in GLPI barcode plugin

75RISK

GitHub PoC★ 1

Sigma-Rule-for-CVE-2021-40438-Attack-Attemp

CVE-2021-40438CRITICALunder attackransomware30 Nov 2021

mod_proxy SSRF

100RISK

GitHub PoC★ 5

Gex is an iOS 14.7 jailbreak using CVE-2021-30807 IOMFB & CVE-2021-30860 exploit(s)

CVE-2021-30807HIGHunder attack30 Nov 2021

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS

76RISK

GitHub PoC★ 1

NSE script to fingerprint if GitLab is vulnerable to cve-2021-22205-nse

CVE-2021-22205CRITICALunder attackransomware27 Nov 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

100RISK

GitHub PoC

Strapi Framework, 3.0.0-beta.17.4

CVE-2019-19609—27 Nov 2021

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin c

35RISK

GitHub PoC★ 2

Proof of concept for CVE-2020-7247 for educational purposes.

CVE-2020-7247CRITICALunder attack26 Nov 2021

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to

100RISK

GitHub PoC

Detect with python and tracking IP

CVE-2018-7600CRITICALunder attackransomware26 Nov 2021

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

GitHub PoC

lisinan988/CVE-2020-0796-exp

CVE-2020-0796CRITICALunder attackransomware25 Nov 2021

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

GitHub PoC

lisinan988/CVE-2017-11882-exp

CVE-2017-11882HIGHunder attackransomware25 Nov 2021

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Mi

100RISK

GitHub PoC

lisinan988/CVE-2021-40444-exp

CVE-2021-40444HIGHunder attackransomware25 Nov 2021

Microsoft MSHTML Remote Code Execution Vulnerability

100RISK

GitHub PoC★ 3

A CVE-2021-22205 Gitlab RCE POC written in Golang

CVE-2021-22205CRITICALunder attackransomware25 Nov 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

100RISK

GitHub PoC

lisinan988/CVE-2018-8174-exp

CVE-2018-8174HIGHunder attackransomware25 Nov 2021

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows

93RISK

GitHub PoC

lisinan988/CVE-2019-0708-scan

CVE-2019-0708CRITICALunder attackransomware25 Nov 2021

A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.