Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,348cataloged exploits
35,507CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,332GitHub PoC 14,156VulnCheck XDB 8,646Nuclei 4,289Metasploit 3,474✓ verified onlyrecentpopularrisk
77,302 exploits
GitHub PoC
Clone from gist
CVE-2021-26855CRITICALunder attackransomware04 Jan 2024
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC
Script to validate WordPress CVE-2022-21661
CVE-2022-21661HIGH04 Jan 2024
SQL injection in WordPress
78RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-27163MEDIUM04 Jan 2024
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
open ↗
GitHub PoC★ 1
touch 生成文件
CVE-2021-4034HIGHunder attackransomware04 Jan 2024
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-26855CRITICALunder attackransomware04 Jan 2024
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC
Sumitpathania03/CVE-2022-22947
CVE-2022-22947CRITICALunder attack03 Jan 2024
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
GitHub PoC★ 3
CVE-2020-11023 PoC for bug bounty.
CVE-2020-11023MEDIUMunder attack03 Jan 2024
Potential XSS vulnerability in jQuery
85RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22947CRITICALunder attack03 Jan 2024
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-1388CRITICALunder attackransomware03 Jan 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
GitHub PoC★ 3
exploit poc
CVE-2022-1388CRITICALunder attackransomware03 Jan 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-22515CRITICALunder attackransomware02 Jan 2024
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-49070—02 Jan 2024
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-29357CRITICALunder attackransomware01 Jan 2024
Microsoft SharePoint Server Elevation of Privilege Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-35813—31 Dec 2023
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experi
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2023-1454MEDIUM31 Dec 2023
jeecg-boot qurestSql sql injection
60RISK
open ↗
VulnCheck XDB
local
CVE-2021-3156HIGHunder attack30 Dec 2023
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-50164—30 Dec 2023
Apache Struts: File upload component had a directory traversal vulnerability
45RISK
open ↗
GitHub PoC★ 1
DASICS-ICT/DASICS-CVE-2021-3156
CVE-2021-3156HIGHunder attack30 Dec 2023
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege
100RISK
open ↗
GitHub PoC
Repository to exploit CVE-2023-46604 reported for ActiveMQ
CVE-2023-46604CRITICALunder attackransomware30 Dec 2023
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-26134CRITICALunder attackransomware29 Dec 2023
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗
VulnCheck XDB
local
CVE-2016-5195HIGHunder attack29 Dec 2023
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗
VulnCheck XDB
infoleak
CVE-2023-27163MEDIUM29 Dec 2023
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baske
48RISK
open ↗
VulnCheck XDB
infoleak
CVE-2023-51467—29 Dec 2023
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
60RISK
open ↗
GitHub PoC
Joomla Information disclosure exploit code written in C++.
CVE-2023-23752MEDIUMunder attack29 Dec 2023
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2023-51467—29 Dec 2023
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2023-51467—29 Dec 2023
Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
60RISK
open ↗
VulnCheck XDB
local
CVE-2021-4034HIGHunder attackransomware29 Dec 2023
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
GitHub PoC
DARKSTUFF-LAB/-CVE-2022-26134
CVE-2022-26134CRITICALunder attackransomware29 Dec 2023
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un
100RISK
open ↗
GitHub PoC
vinnie1717/CVE-2023-48974
CVE-2023-48974CRITICAL28 Dec 2023
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges
48RISK
open ↗
GitHub PoC★ 3
CVE-2006-2842 is a powerful scanner for bug bounty hunters and penetration testers to discover vulnerabilities in their web applications.
CVE-2006-2842—28 Dec 2023
PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals i
50RISK
open ↗
← previouspage 436 / 2,577next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.