Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,151cataloged exploits
35,370CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,233GitHub PoC 14,119VulnCheck XDB 8,617Nuclei 4,257Metasploit 3,474✓ verified onlyrecentpopularrisk
77,151 exploits
VulnCheck XDB
initial-access
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗GitHub PoC★ 1
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
75RISK
open ↗GitHub PoC★ 4
jakabakos/CVE-2024-27348-Apache-HugeGraph-RCE
Apache HugeGraph-Server: Command execution in gremlin
100RISK
open ↗GitHub PoC
Rejetto http File Server 2.3.x (Reverse shell)
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗GitHub PoC★ 2
POC for CVE-2024-4577 with Shodan integration
Argument Injection in PHP-CGI
100RISK
open ↗GitHub PoC★ 25
Ivanti EPM SQL Injection Remote Code Execution Vulnerability
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att
100RISK
open ↗GitHub PoC
raytran54/CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
Vietnam National Cyber Security (NCS)'s Internship - 2nd Test
Argument Injection in PHP-CGI
100RISK
open ↗VulnCheck XDB
remote-with-credentials
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
63RISK
open ↗VulnCheck XDB
initial-access
Likeshop HTTP POST Request File.php userFormImage unrestricted upload
78RISK
open ↗VulnCheck XDB
local
An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an I
41RISK
open ↗Metasploit600
Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes
Win32k Elevation of Privilege Vulnerability
36RISK
open ↗Metasploit600
Windows Access Mode Mismatch LPE in ks.sys
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
91RISK
open ↗Metasploit300
Magento XXE Unserialize Arbitrary File Read
XXE can expose crypt key and other secrets granting full admin access
100RISK
open ↗GitHub PoC
CVE-2022-36446 POC 실습
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗GitHub PoC★ 4
NanoWraith/CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.