Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
77,866 exploits
VulnCheck XDB
initial-access
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,
100RISK
open ↗GitHub PoC★ 36
Proof of Concept Exploit for ManageEngine ServiceDesk Plus CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014
100RISK
open ↗GitHub PoC★ 270
A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / decrypt data_source info automatic.
Grafana path traversal
100RISK
open ↗GitHub PoC★ 6
利用grafan CVE-2021-43798任意文件读漏洞，自动探测是否有漏洞、存在的plugin、提取密钥、解密server端db文件，并输出data_sourrce信息。
Grafana path traversal
100RISK
open ↗GitHub PoC★ 369
Grafana Unauthorized arbitrary file reading vulnerability
Grafana path traversal
100RISK
open ↗GitHub PoC★ 12
Grafanav8.*版本任意文件读取漏洞批量检测工具：该漏洞目前为0day漏洞，未授权的攻击者利用该漏洞，能够获取服务器敏感文件。
Grafana path traversal
100RISK
open ↗Exploit-DB
Croogo 3.0.2 - Remote Code Execution (Authenticated)
A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malic
23RISK
open ↗GitHub PoC
reverse shell execution exploit of CVE 22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec
100RISK
open ↗GitHub PoC★ 9
zer0yu/CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗GitHub PoC★ 41
CVE-2021-43798 - Grafana 8.x Path Traversal (Pre-Auth)
Grafana path traversal
100RISK
open ↗Exploit-DB
Auerswald COMpact 8.0B - Multiple Backdoors
Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web
60RISK
open ↗GitHub PoC★ 18
CVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)
Windows Print Spooler Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 8
Microsoft Exchange ProxyLogon PoC (CVE-2021-26855)
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗VulnCheck XDB
initial-access
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC
sinisterghost/https-github.com-iBearcat-CVE-2018-8174_EXP
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows
93RISK
open ↗VulnCheck XDB
initial-access
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISK
open ↗VulnCheck XDB
initial-access
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a
100RISK
open ↗Exploit-DB
WordPress Plugin DZS Zoomsounds 6.45 - Arbitrary File Read (Unauthenticated)
ZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information Dislosure
68RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.