Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,305cataloged exploits

36,465CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecent popular risk

79,230 exploits

GitHub PoC

Known security vulnerabilities detected. CVE-2022-21831 Critical severity CVE-2025-24293 Critical severity CVE-2020-8162 High severity CVE-2024-26144 Moderate severity

CVE-2025-24293CRITICAL05 Apr 2020

# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of pote

63RISK

GitHub PoC★ 2

CVE-2020-0688 "Microsoft Exchange default MachineKeySection deserialize vulnerability"

CVE-2020-0688HIGHunder attackransomware05 Apr 2020

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle o

100RISK

GitHub PoC★ 6

Laravel-PHP-Unit-RCE (CVE-2018-15133) Auto Exploiter and Shell Uploader

CVE-2018-15133HIGHunder attack05 Apr 2020

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

100RISK

GitHub PoC★ 4

XAMPP - CVE-2020-11107

CVE-2020-11107—05 Apr 2020

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged

28RISK

VulnCheck XDB

initial-access

CVE-2018-15133HIGHunder attack05 Apr 2020

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unseri

100RISK

GitHub PoC★ 27

PoCs for CVE-2020-11108; an RCE and priv esc in Pi-hole

CVE-2020-11108—04 Apr 2020

The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abus

60RISK

GitHub PoC★ 2

rhbb/CVE-2019-17671

CVE-2019-17671—03 Apr 2020

In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is m

50RISK

VulnCheck XDB

initial-access

CVE-2019-7609CRITICALunder attack03 Apr 2020

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker

100RISK

VulnCheck XDB

client-side

CVE-2018-20250HIGHunder attackransomware03 Apr 2020

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field o

100RISK

GitHub PoC★ 1

rhbb/CVE-2019-7609

CVE-2019-7609CRITICALunder attack03 Apr 2020

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker

100RISK

GitHub PoC★ 31

This is a writeup for CVE-2020-11107 reported by Maximilian Barz

CVE-2020-11107—03 Apr 2020

An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged

28RISK

GitHub PoC★ 1

CVE-2020-0796-EXP

CVE-2020-0796CRITICALunder attackransomware02 Apr 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

GitHub PoC★ 33

该资源为CVE-2020-0796漏洞复现，包括Python版本和C++版本。主要是集合了github大神们的资源，希望您喜欢~

CVE-2020-0796CRITICALunder attackransomware02 Apr 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

Metasploit300

LimeSurvey Zip Path Traversals

CVE-2019-9960—02 Apr 2020

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relati

23RISK

Metasploit300

LimeSurvey Zip Path Traversals

CVE-2020-11455—02 Apr 2020

LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileM

60RISK

GitHub PoC★ 65

jiansiting/CVE-2020-0796

CVE-2020-0796CRITICALunder attackransomware01 Apr 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

GitHub PoC★ 4,291

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

CVE-2020-14882CRITICALunder attack01 Apr 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISK

GitHub PoC

A simple dos-tool

CVE-1999-0016—01 Apr 2020

Land IP denial of service.

45RISK

VulnCheck XDB

initial-access

CVE-2020-0796CRITICALunder attackransomware01 Apr 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

VulnCheck XDB

local

CVE-2020-0796CRITICALunder attackransomware01 Apr 2020

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol h

100RISK

VulnCheck XDB

initial-access

CVE-2020-14882CRITICALunder attack01 Apr 2020

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

100RISK

VulnCheck XDB

local

CVE-2018-8120HIGHunder attackransomware01 Apr 2020

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

100RISK

VulnCheck XDB

initial-access

CVE-2019-17558HIGHunder attack01 Apr 2020

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

100RISK

GitHub PoC★ 4,291

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

CVE-2019-17558HIGHunder attack01 Apr 2020

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

100RISK

VulnCheck XDB

initial-access

CVE-2020-8515CRITICALunder attack31 Mar 2020

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow

100RISK

Exploit-DB✓ VexDay Proof

IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)

CVE-2019-4716CRITICALunder attackremotemultiple31 Mar 2020

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use

100RISK

Exploit-DB✓ VexDay Proof

DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)

CVE-2019-20499—remotehardware31 Mar 2020

D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Config

60RISK

Exploit-DB

Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection

CVE-2020-5726—webappshardware31 Mar 2020

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A rem

23RISK

GitHub PoC★ 257

Exploits for Android Binder bug CVE-2020-0041

CVE-2020-0041HIGHunder attack31 Mar 2020

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could

71RISK

VulnCheck XDB

local

CVE-2020-0041HIGHunder attack31 Mar 2020

In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could

71RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.