Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits

35,840CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

77,866 exploits

GitHub PoC

A vulnerability scanner that detects CVE-2021-21980 vulnerabilities.

CVE-2022-1388CRITICALunder attackransomware07 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

GitHub PoC★ 2

fuzzing with libFuzzer，inlude openssl heartbleed (CVE-2014-0160)

CVE-2014-0160HIGHunder attack07 May 2022

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe

100RISK

open ↗

GitHub PoC

jr64/CVE-2015-0311

CVE-2015-0311HIGHunder attack07 May 2022

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window

100RISK

open ↗

VulnCheck XDB

infoleak

CVE-2020-3452HIGHunder attack07 May 2022

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2021-43287—07 May 2022

An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default,

43RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-29464CRITICALunder attackransomware07 May 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RISK

open ↗

VulnCheck XDB

local

CVE-2015-0311HIGHunder attack07 May 2022

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window

100RISK

open ↗

GitHub PoC★ 1

cve-2022-29464 EXP

CVE-2022-29464CRITICALunder attackransomware07 May 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RISK

open ↗

GitHub PoC

Just proof of concept for Cisco CVE-2020-3452. Using external or internal file base.

CVE-2020-3452HIGHunder attack07 May 2022

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability

100RISK

open ↗

GitHub PoC

Satheesh575555/external_expat_AOSP10_r33_CVE-2022-25236

CVE-2022-25236CRITICAL06 May 2022

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace

60RISK

open ↗

GitHub PoC★ 28

This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only.

CVE-2022-1388CRITICALunder attackransomware06 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

GitHub PoC★ 16

may the poc with you

CVE-2022-1040CRITICALunder attack06 May 2022

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho

100RISK

open ↗

GitHub PoC★ 6

WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation

CVE-2022-0441—06 May 2022

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

60RISK

open ↗

VulnCheck XDB

infoleak

CVE-2022-1388CRITICALunder attackransomware06 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-1388CRITICALunder attackransomware05 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-1388CRITICALunder attackransomware05 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2022-29464CRITICALunder attackransomware05 May 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RISK

open ↗

GitHub PoC★ 1

CVE-2022-29464CRITICALunder attackransomware05 May 2022

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

100RISK

open ↗

GitHub PoC

CVE-2022-22954 analyst

CVE-2022-22954CRITICALunder attackransomware05 May 2022

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa

100RISK

open ↗

GitHub PoC★ 53

K23605346: BIG-IP iControl REST vulnerability CVE-2022-1388

CVE-2022-1388CRITICALunder attackransomware05 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

GitHub PoC★ 25

Simple script realizado en bash, para revisión de múltiples hosts para CVE-2022-1388 (F5)

CVE-2022-1388CRITICALunder attackransomware05 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

Metasploit600

F5 BIG-IP iControl RCE via REST Authentication Bypass

CVE-2022-1388CRITICALunder attackransomware04 May 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13

100RISK

open ↗

VulnCheck XDB

local

CVE-2021-22204MEDIUMunder attack03 May 2022

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISK

open ↗

Metasploit600

DotCMS RCE via Arbitrary File Upload.

CVE-2022-26352CRITICALunder attackransomware03 May 2022

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form req

100RISK

open ↗

GitHub PoC

CVE-2018-17553 PoC

CVE-2018-17553—03 May 2022

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs N

60RISK

open ↗

GitHub PoC★ 13

PoC of CVE-2022-24707

CVE-2022-24707HIGH03 May 2022

SQL injection in anuko timetracker

41RISK

open ↗

GitHub PoC

Willian-2-0-0-1/Log4j-Exploit-CVE-2021-44228

CVE-2021-44228CRITICALunder attackransomware02 May 2022

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

open ↗

GitHub PoC★ 12

Exploit for CVE-2021-3560 (Polkit) - Local Privilege Escalation

CVE-2021-3560HIGHunder attack02 May 2022

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RISK

open ↗

VulnCheck XDB

local

CVE-2021-3560HIGHunder attack02 May 2022

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privile

91RISK

open ↗

GitHub PoC★ 60

yuanLink/CVE-2022-26809

CVE-2022-26809CRITICAL01 May 2022

Remote Procedure Call Runtime Remote Code Execution Vulnerability

70RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.