Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
76,976cataloged exploits
35,273CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,445Referência 22,166GitHub PoC 14,070VulnCheck XDB 8,571Nuclei 4,251Metasploit 3,473✓ verified onlyrecentpopularrisk
76,559 exploits
GitHub PoC
pwning netconsd
netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could
48RISK
open ↗GitHub PoC
🚨 New Incident Report Completed! 🚨 Just wrapped up "Event ID 268: SOC292 - Possible PHP Injection Detected (CVE-2024-4577)" on LetsDefend.io. This analysis involved investigating an attempted Command Injection targeting our PHP server. Staying ahead of these threats with continuous monitoring and swift containment! 🛡️
Argument Injection in PHP-CGI
100RISK
open ↗Metasploit300
WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
68RISK
open ↗Metasploit300
WordPress LearnPress Unauthenticated SQLi (CVE-2024-8522, CVE-2024-8529)
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
75RISK
open ↗GitHub PoC
CVE Exploitation Reports: CVE-2007-3280, CVE-2017-0144, CVE-2019-0708
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗GitHub PoC
CVE Exploitation Reports: CVE-2007-3280, CVE-2017-0144, CVE-2019-0708
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗GitHub PoC★ 1
Powershell script that checks for cert padding in the Windows Registry and adds it if it does not exist. Meant to resolve the WinTrustVerify Vulnerability.
WinVerifyTrust Signature Validation Vulnerability
75RISK
open ↗GitHub PoC
My proof of concept for CVE-2019 Microsoft-Edge
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi
45RISK
open ↗GitHub PoC
Log4J exploit CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
OtisSymbos/CVE-2021-44228-Log4Shell-
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 2
Spring Cloud Remote Code Execution
CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
60RISK
open ↗VulnCheck XDB
initial-access
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISK
open ↗GitHub PoC★ 3
Analysis , Demo exploit and poc about CVE-2024-37084
CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
60RISK
open ↗GitHub PoC★ 3
JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
48RISK
open ↗GitHub PoC
carradolly/CVE-2015-8660
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
43RISK
open ↗GitHub PoC
Python3 toolkit update
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗VulnCheck XDB
client-side
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Window
100RISK
open ↗Metasploit300
Vicidial SQL Injection Time-based Admin Credentials Enumeration
VICIdial Unauthenticated SQL Injection
85RISK
open ↗Metasploit600
VICIdial Authenticated Remote Code Execution
VICIdial Authenticated Remote Code Execution
58RISK
open ↗GitHub PoC★ 1
KaoXx/CVE-2022-37706
enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and th
56RISK
open ↗GitHub PoC★ 1
Scanning CVE-2024-4577 vulnerability with a url list.
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 5
CVE-2024-28000 Exploit for litespeed-cache =<6.3 allows Privilege Escalation with creation of administrator account
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISK
open ↗GitHub PoC★ 1
Artemisxxx37/OverlayFS-PrivEsc-CVE-2022-0944
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISK
open ↗GitHub PoC★ 1
CVE-2024-38063 - Remotely Exploiting The Kernel Via IPv6
Windows TCP/IP Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC★ 9
0xRoqeeb/sqlpad-rce-exploit-CVE-2022-0944
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISK
open ↗GitHub PoC★ 5
SQLPad - Template injection (POC exploit for SQLPad RCE [CVE-2022-0944])
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISK
open ↗GitHub PoC
PoC code written for CVE-2022-0944 to make exploitation easier. Based on information found here: https://huntr.com/bounties/46630727-d923-4444-a421-537ecd63e7fb
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.