Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
77,449cataloged exploits
35,552CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,451Referência 22,367GitHub PoC 14,225VulnCheck XDB 8,649Nuclei 4,283Metasploit 3,474✓ verified onlyrecentpopularrisk
77,302 exploits
VulnCheck XDB
infoleak
WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability
63RISK
open ↗VulnCheck XDB
initial-access
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker
100RISK
open ↗GitHub PoC★ 2
Automating Exploitation of CVE-2022-44268 ImageMagick Arbitrary File Read
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti
55RISK
open ↗VulnCheck XDB
client-side
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
Muhammad-Ali007/Follina_MSDT_CVE-2022-30190
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
d0x-awrqxavc/CVE-2019-7609-KibanaRCE
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker
100RISK
open ↗GitHub PoC★ 6
Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints
WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability
63RISK
open ↗GitHub PoC★ 15
Script to check for CVE-2023-36884 hardening
Windows Search Remote Code Execution Vulnerability
93RISK
open ↗GitHub PoC★ 2
This script allows for remote code execution (RCE) on Oracle WebLogic Server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗VulnCheck XDB
initial-access
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions
100RISK
open ↗VulnCheck XDB
initial-access
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗GitHub PoC
Fuel CMS 1.4.1 - Remote Code Execution - Python 3.x
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗GitHub PoC★ 4
NyaMeeEain/CVE-2022-28171-POC
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to t
53RISK
open ↗Exploit-DB
Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability
85RISK
open ↗Exploit-DB
WinterCMS < 1.2.3 - Persistent Cross-Site Scripting
Winter CMS vulnerable to stored XSS through privileged upload of SVG file
28RISK
open ↗GitHub PoC★ 2
This is an emergency solution while Microsoft addresses the vulnerability.
Windows Search Remote Code Execution Vulnerability
93RISK
open ↗Exploit-DB
Icinga Web 2.10 - Authenticated Remote Code Execution
Arbitrary code execution for authenticated users in Icinga Web 2
46RISK
open ↗GitHub PoC
Pog-Frog/cve-2022-44268
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulti
55RISK
open ↗VulnCheck XDB
remote-with-credentials
Microsoft Outlook Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC★ 22
Muhammad-Ali007/OutlookNTLM_CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC★ 46
Apache RocketMQ Arbitrary File Write Vulnerability Exploit
Apache RocketMQ: Possible remote code execution when using the update configuration function
85RISK
open ↗VulnCheck XDB
initial-access
Apache RocketMQ: Possible remote code execution when using the update configuration function
85RISK
open ↗GitHub PoC★ 1
CVE-2023-33592批量漏洞利用程序
Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lf
23RISK
open ↗VulnCheck XDB
initial-access
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co
100RISK
open ↗GitHub PoC
Proof of concept for LabVIEW Web Server HTTP Get Newline DoS vulnerability
LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service (crash) via an HTTP GET reques
28RISK
open ↗Metasploit600
BoidCMS Command Injection
File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header t
50RISK
open ↗VulnCheck XDB
client-side
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corru
76RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.