Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC
CVE-2026-61628 - nginx-ignition - High 8.1 - Unauthenticated Privilege Escalation (Administrator Account Creation)
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
41RISK
open ↗GitHub PoC★ 1
WordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-13355 PoC — Meta Box AIO ≤3.11.0 unauthenticated admin privesc via MB Frontend Submission + User Profile shortcode chain. Python check/exploit, FOFA helper, mass scan with live flow.
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISK
open ↗GitHub PoC★ 45
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗VulnCheck XDB
initial-access
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISK
open ↗GitHub PoC
This project describes detailed information about the CVE-2026-51772 vulnerability.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multi
33RISK
open ↗GitHub PoC
pwnVader/CVE-2026-87902-PoC-pwnVader
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC★ 9
Unauthenticated RCE on Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC
Simple Checks to look for indicators of compromise
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
100RISK
open ↗GitHub PoC★ 36
CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC
CVE-2026-68376 - Ubuntu Kernel 7.0.0-30
sctp: fix auth_hmacs array size in struct sctp_cookie
41RISK
open ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISK
open ↗GitHub PoC
Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versi
28RISK
open ↗GitHub PoC★ 4
POC-CVE-2026-93674 Authenticated Blind command injection proof of concept exploit code
Langflow OSS is affected by multiple vulnerabilities
68RISK
open ↗GitHub PoC
CVE-2026-93485 - Draft or TODO
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISK
open ↗GitHub PoC
Laboratório de pentest em rede isolada: enumeração com nmap/nikto e exploração manual do Metasploitable2 (backdoor vsFTPd CVE-2011-2523, bindshell) com relatório técnico completo.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
56RISK
open ↗VulnCheck XDB
initial-access
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC
pwnVader/CVE-2026-87915-PoC-pwnVader
Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
41RISK
open ↗GitHub PoC★ 1
HPLIP < 3.26.6 — Full admin takeover via PAPPL web interface (no auth). Related to CVE-2026-91097 through CVE-2026-91106 (CVSS 9.3)
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
41RISK
open ↗GitHub PoC
griisemine/cve-2026-87902-detection
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
100RISK
open ↗GitHub PoC
pwnVader/CVE-2026-17089-PoC-pwnVader
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
33RISK
open ↗GitHub PoC★ 58
cve-2026-86060 PoC
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISK
open ↗GitHub PoC
pwnVader/CVE-2026-88877-PoC-pwnVader
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
48RISK
open ↗GitHub PoC★ 1
Neutralizing CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) via modern eBPF, module disarmament, and containerd user namespaces.
netfilter: bridge: make ebt_snat ARP rewrite writable
71RISK
open ↗Metasploit600
Langflow AI Auth Blind Command Injection
Langflow OSS is affected by multiple vulnerabilities
68RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.