Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,900cataloged exploits
35,840CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,600GitHub PoC 14,323VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecentpopularrisk
77,900 exploits
GitHub PoC★ 16
CVE-2022-0185 exploit rewritten with pipe primitive
CVE-2022-0185HIGHunder attack05 Apr 2022
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functio
76RISK
open ↗
GitHub PoC★ 1
Spring has Confirmed the RCE in Spring Framework. The team has just published the statement along with the mitigation guides for the issue. Now, this vulnerability can be tracked as CVE-2022-22965.
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC
Spring4Shell is a critical RCE vulnerability in the Java Spring Framework and is one of three related vulnerabilities published on March 30
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC
Spring Framework RCE Exploit
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 1
CVE-2022-22963 research
CVE-2022-22963CRITICALunder attack05 Apr 2022
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
open ↗
GitHub PoC★ 3
Exploit Of Spring4Shell!
CVE-2022-22965CRITICALunder attack05 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 3
CVE-2020-24186的攻击脚本
CVE-2020-24186CRITICAL05 Apr 2022
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RISK
open ↗
GitHub PoC
Proof-of-concept exploit for CVE-2016-1827 on OS X Yosemite.
CVE-2016-1827—04 Apr 2022
The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers
28RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware04 Apr 2022
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
GitHub PoC★ 7
CVE-2022-22965 (Spring4Shell) Proof of Concept
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 12
Vulnerability scanner for Spring4Shell (CVE-2022-22965)
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
Spring4Shell - CVE-2022-22965
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
Intentionally vulnerable Spring app to test CVE-2022-22965
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 3
Another spring4shell (Spring core RCE) POC
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 1
PowerShell port of CVE-2022-22965 vulnerability check by colincowie.
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
denial-of-service
CVE-2022-21907CRITICAL04 Apr 2022
HTTP Protocol Stack Remote Code Execution Vulnerability
70RISK
open ↗
GitHub PoC★ 128
A REAL DoS exploit for CVE-2022-21907
CVE-2022-21907CRITICAL04 Apr 2022
HTTP Protocol Stack Remote Code Execution Vulnerability
70RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack04 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-42013CRITICALunder attackransomware04 Apr 2022
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-21975HIGHunder attackransomware03 Apr 2022
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2022-22965CRITICALunder attack03 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 2
Spring Cloud Function SpEL - cve-2022-22963
CVE-2022-22963CRITICALunder attack03 Apr 2022
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
open ↗
GitHub PoC★ 16
Docker PoC for CVE-2022-22965 with Spring Boot version 2.6.5
CVE-2022-22965CRITICALunder attack03 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC★ 8
Nmap Spring4Shell NSE script for Spring Boot RCE (CVE-2022-22965)
CVE-2022-22965CRITICALunder attack03 Apr 2022
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
100RISK
open ↗
GitHub PoC
Linux “Dirty Pipe” vulnerability gives unprivileged users root access
CVE-2022-0847HIGHunder attack03 Apr 2022
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗
VulnCheck XDB
remote-with-credentials
CVE-2017-9506—03 Apr 2022
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before
60RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-40438CRITICALunder attackransomware03 Apr 2022
mod_proxy SSRF
100RISK
open ↗
← previouspage 593 / 2,597next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.