CatalogAbout
About
vuln2shell is a public catalog of high-visibility vulnerabilities that can get an attacker a shell. It exists so defenders can see patch status, exploitation, affected versions, detection, and vendor advisories in one place, without wading through a dozen vendor blogs for each CVE.
What you will find
Each page covers one shell-class or RCE bug: what the bug is, a high-level attack path, exploitation status (including CISA KEV), dated seen-in-the-wild snapshots when public figures exist, defender actions, detection rules, vendor signatures, advisories, affected versions, a timeline, and a PoC index for defenders. There is also a vendor advisories directory for the product and security vendors we check.
How sourcing works
Pages use public sources only: vendor advisories, CISA KEV, researcher write-ups, and other documents anyone can open. Every dated claim on a page comes from those sources. We do not invent CVEs, timestamps, or indicators.
A product is never marked vendor-stated not affected without a vendor statement object (vendor, date, quote or URL). Until that statement exists, the row stays no-statement-yet. Under investigation and none currently known affected also require a vendor statement.
The PoC index is for defenders. It lists public proof-of-concept links with a source and a validation status. This site does not publish exploit code, payloads, or reproduction steps.
Detection rules we write
Detection queries marked as origin vuln2shell are our own. Those rules are dedicated to the public domain under CC0 1.0. Vendor and community rules keep the licence named on the source.