Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

78,137cataloged exploits
35,961CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,458Referência 22,657GitHub PoC 14,424VulnCheck XDB 8,773Nuclei 4,340Metasploit 3,485✓ verified onlyrecentpopularrisk
77,900 exploits
GitHub PoC
Alexcot25051999/CVE-2021-40444
CVE-2021-40444HIGHunder attackransomware22 Nov 2021
Microsoft MSHTML Remote Code Execution Vulnerability
100RISK
open ↗
VulnCheck XDB
infoleak
CVE-2021-41277CRITICALunder attack22 Nov 2021
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗
GitHub PoC★ 5
simple program for exploit metabase
CVE-2021-41277CRITICALunder attack22 Nov 2021
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗
GitHub PoC
MetaBase 任意文件读取漏洞 fofa批量poc
CVE-2021-41277CRITICALunder attack22 Nov 2021
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗
GitHub PoC
Metabase 任意文件读取
CVE-2021-41277CRITICALunder attack22 Nov 2021
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗
GitHub PoC★ 17
对Exchange Proxyshell 做了二次修改，精确的拆分、实现辅助性安全测试。
CVE-2021-34473CRITICALunder attackransomware22 Nov 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-34473CRITICALunder attackransomware22 Nov 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC
hzshang/CVE-2021-31956
CVE-2021-31956HIGHunder attack22 Nov 2021
Windows NTFS Elevation of Privilege Vulnerability
76RISK
open ↗
VulnCheck XDB
client-side
CVE-2021-33044CRITICALunder attack22 Nov 2021
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by
100RISK
open ↗
GitHub PoC
A write up on the THM room Vulnerability Capstone & Exploit script for CVE-2018-16763.
CVE-2018-16763—22 Nov 2021
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-16763—22 Nov 2021
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This ca
60RISK
open ↗
GitHub PoC★ 2
CrackerCat/CVE-2021-26411
CVE-2021-26411HIGHunder attackransomware22 Nov 2021
Internet Explorer Memory Corruption Vulnerability
93RISK
open ↗
VulnCheck XDB
local
CVE-2021-3493HIGHunder attack21 Nov 2021
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
open ↗
VulnCheck XDB
local
CVE-2021-3493HIGHunder attack21 Nov 2021
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o
98RISK
open ↗
GitHub PoC★ 4
Druva inSync Windows Client 6.6.3 - Local Privilege Escalation (PowerShell) RCE
CVE-2020-5752—21 Nov 2021
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitra
38RISK
open ↗
GitHub PoC★ 11
PoC for CVE-2021-41277
CVE-2021-41277CRITICALunder attack21 Nov 2021
GeoJSON URL validation can expose server files and environment variables to unauthorized users
100RISK
open ↗
VulnCheck XDB
local
CVE-2021-22555HIGHunder attack19 Nov 2021
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
100RISK
open ↗
GitHub PoC
CVE-2021-43617 bypass CRF
CVE-2021-43617—19 Nov 2021
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Val
28RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-41773HIGHunder attackransomware19 Nov 2021
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2018-7600CRITICALunder attackransomware18 Nov 2021
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗
GitHub PoC★ 1
CVE-2013-2171
CVE-2013-2171—18 Nov 2021
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEAS
38RISK
open ↗
VulnCheck XDB
initial-access
CVE-2017-17562HIGHunder attack17 Nov 2021
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISK
open ↗
Exploit-DB
GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
CVE-2021-22205CRITICALunder attackransomwarewebappsruby17 Nov 2021
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-22205CRITICALunder attackransomware17 Nov 2021
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati
100RISK
open ↗
Exploit-DB
Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)
CVE-2021-35323—webappsphp17 Nov 2021
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.
38RISK
open ↗
GitHub PoC★ 1
PoC for CVE-2017-17562 written in bash
CVE-2017-17562HIGHunder attack17 Nov 2021
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. T
100RISK
open ↗
Exploit-DB✓ VexDay Proof
SuiteCRM 7.11.18 - Remote Code Execution (RCE) (Authenticated) (Metasploit)
CVE-2021-42840—webappsphp17 Nov 2021
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumsta
50RISK
open ↗
VulnCheck XDB
initial-access
CVE-2021-37580—17 Nov 2021
Apache ShenYu Admin bypass JWT authentication
50RISK
open ↗
GitHub PoC
cve-2020-35314,一个带phpcode的zip文件
CVE-2020-35314—17 Nov 2021
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, al
28RISK
open ↗
Exploit-DB
Online Learning System 2.0 - Remote Code Execution (RCE)
CVE-2021-42580—webappsphp16 Nov 2021
Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/adm
23RISK
open ↗
← previouspage 638 / 2,597next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.