Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC
single PoC for CVE-2026-18143 Unauth AFU (Arbitrary File Upload)
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISK
open ↗GitHub PoC★ 2
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗GitHub PoC
Local classroom demo of NoSQL operator injection in LangGraph's MongoDBSaver (GHSA-98xf-r82g-9mhx / CVE-2026-48121). Fictional data only.
@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
33RISK
open ↗GitHub PoC
Authlib 1.7.2: Signature Verification Bypass - General JSON JWS Accepts Unsigned Payload when `signatures` is Empty
Authlib library contains a signature‑verification bypass vulnerability
48RISK
open ↗GitHub PoC
JailBr3ak/CVE-2026-97347
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
41RISK
open ↗VulnCheck XDB
info-leak
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
78RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103440
pagetriagelist discloses suppressed reviewer usernames
28RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
28RISK
open ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗VulnCheck XDB
initial-access
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISK
open ↗VulnCheck XDB
initial-access
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
63RISK
open ↗VulnCheck XDB
initial-access
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
100RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS
28RISK
open ↗GitHub PoC
CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
48RISK
open ↗GitHub PoC★ 1
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISK
open ↗GitHub PoC★ 2
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗GitHub PoC★ 1
CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISK
open ↗GitHub PoC★ 2
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103441
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
41RISK
open ↗VulnCheck XDB
initial-access
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
100RISK
open ↗GitHub PoC★ 2
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISK
open ↗GitHub PoC★ 1
CVE-2026-102427 is an unauthenticated remote code execution flaw in OrdaSoft Joomla Content Construction Kit (OS CCK) — Joomla component com_os_cck.
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
48RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103442
MergeAccount PHP object injection via session-key substitution
41RISK
open ↗GitHub PoC
CVE-2026-102425 PoC (PoCbit) — Joomla Balbooa Forms (com_baforms) <2.4.3.4 unauth RCE via field shortcode injection in post-submission PHP eval(). check + exploit + mass bulk. https://pocbit.org/pocs/cve-2026-102425
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RISK
open ↗GitHub PoC
wuyou6956-glitch/cve-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.