Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,533cataloged exploits

35,607CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,455Referência 22,407GitHub PoC 14,247VulnCheck XDB 8,663Nuclei 4,287Metasploit 3,474✓ verified onlyrecent popular risk

77,449 exploits

GitHub PoC★ 3

CVE-2023-33246：Apache RocketMQ 远程命令执行漏洞检测工具

CVE-2023-33246CRITICALunder attack02 Jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-0441—02 Jun 2023

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RISK

open ↗

GitHub PoC

[CVE-2021-33690] Server Side Request Forgery vulnerability in SAP NetWeaver Development Infrastructure

CVE-2021-33690CRITICAL01 Jun 2023

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Compo

75RISK

open ↗

Metasploit600

Chamilo unauthenticated command injection in PowerPoint upload

CVE-2023-34960—01 Jun 2023

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to ex

60RISK

open ↗

Metasploit600

Splunk "edit_user" Capability Privilege Escalation

CVE-2023-32707HIGH01 Jun 2023

‘edit_user’ Capability Privilege Escalation

78RISK

open ↗

VulnCheck XDB

infoleak

CVE-2021-33690CRITICAL01 Jun 2023

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Compo

75RISK

open ↗

GitHub PoC★ 114

Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit

CVE-2023-33246CRITICALunder attack01 Jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

GitHub PoC★ 81

Apache RocketMQ 远程代码执行漏洞(CVE-2023-33246) Exploit

CVE-2023-33246CRITICALunder attack01 Jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2023-33246CRITICALunder attack01 Jun 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

Exploit-DB

Pydio Cells 4.1.2 - Unauthorised Role Assignments

CVE-2023-32749HIGHwebappsgo31 May 2023

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying t

46RISK

open ↗

Exploit-DB

Pydio Cells 4.1.2 - Cross-Site Scripting (XSS) via File Download

CVE-2023-32751MEDIUMwebappsgo31 May 2023

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are genera

33RISK

open ↗

Exploit-DB

unilogies/bumsys v1.0.3 beta - Unrestricted File Upload

CVE-2023-0455HIGHwebappsphp31 May 2023

Unrestricted Upload of File with Dangerous Type in unilogies/bumsys

41RISK

open ↗

Exploit-DB✓ VexDay Proof

Faculty Evaluation System 1.0 - Unauthenticated File Upload

CVE-2023-33440HIGHwebappsphp31 May 2023

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_u

61RISK

open ↗

Exploit-DB✓ VexDay Proof

Online Security Guards Hiring System 1.0 - Reflected XSS

CVE-2023-0527LOWwebappsphp31 May 2023

PHPGurukul Online Security Guards Hiring System search-request.php cross site scripting

43RISK

open ↗

GitHub PoC★ 2

4mazing/CVE-2023-33246-Copy

CVE-2023-33246CRITICALunder attack31 May 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

Exploit-DB

Flexense HTTP Server 10.6.24 - Buffer Overflow (DoS) (Metasploit)

CVE-2018-8065—remotemultiple31 May 2023

An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access v

60RISK

open ↗

GitHub PoC★ 2

A simple python script for a firewall rule that blocks incoming requests based on the Spring4Shell (CVE-2022-22965) vulnerability

CVE-2022-22965CRITICALunder attack31 May 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

Metasploit600

MOVEit SQL Injection vulnerability

CVE-2023-34362CRITICALunder attackransomware31 May 2023

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.

100RISK

open ↗

Exploit-DB

Pydio Cells 4.1.2 - Server-Side Request Forgery

CVE-2023-32750MEDIUMwebappsgo31 May 2023

Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which

33RISK

open ↗

GitHub PoC★ 1

Exploit for CVE:2010-2075. This exploit allows remote command execution in UnrealIRCd 3.2.8.1.

CVE-2010-2075—31 May 2023

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally

60RISK

open ↗

Metasploit600

Wordpress File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution through shortcode

CVE-2023-2068—31 May 2023

File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

50RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-22965CRITICALunder attack31 May 2023

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-26134CRITICALunder attackransomware30 May 2023

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2023-33246CRITICALunder attack30 May 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

GitHub PoC★ 1

eScan Management Console version 14.0.1400.2281 contains privilege escalation via `GetUserCurrentPwd` function lets attackers retrieve any user's password in plain text.

CVE-2023-33730CRITICAL30 May 2023

Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2

48RISK

open ↗

VulnCheck XDB

initial-access

CVE-2021-1675HIGHunder attackransomware30 May 2023

Windows Print Spooler Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 62

I5N0rth/CVE-2023-33246

CVE-2023-33246CRITICALunder attack30 May 2023

Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

100RISK

open ↗

GitHub PoC

the proof of concept written in Python for an unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. This is a critical severity issue

CVE-2023-2825CRITICAL30 May 2023

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a

85RISK

open ↗

Metasploit600

Dolibarr ERP/CRM Authenticated Code Injection

CVE-2023-30253HIGH29 May 2023

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instea

58RISK

open ↗

VulnCheck XDB

initial-access

CVE-2023-32243CRITICAL29 May 2023

WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

85RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.