Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
86,001cataloged exploits
40,084CVEs with public exploitation
24,696lab-tested
AllReferência 25,989Exploit-DB 24,488GitHub PoC 17,519VulnCheck XDB 9,945Nuclei 4,531Metasploit 3,529✓ verified onlyrecentpopularrisk
17,519 exploits
GitHub PoC★ 1
QNAP password reset URL injection writeup + PoC.
QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
28RISK
open ↗GitHub PoC
Proof of Concept (PoC) for CVE-2026-49975 – HTTP/2 server memory exhaustion attack leveraging HPACK amplification and connection retention (HTTP/2 Slowloris).
Apache HTTP Server: mod_http2 denial of service
53RISK
open ↗GitHub PoC★ 6
Public PoC and detector for CVE-2026-20896 ("Gitea Docker: One Header, Any User")
Gitea Docker image trusts spoofable reverse-proxy headers by default
63RISK
open ↗GitHub PoC★ 4
Pre-auth path traversal to arbitrary file delete in Avada (Fusion) Builder <= 3.15.3 leading to RCE (CVSS 9.1)
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
63RISK
open ↗GitHub PoC
CVE-2026-49049 - Unauthenticated File Deletion, Arbitrary Write & XSS Injection for Helix3 Joomla Extension
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RISK
open ↗GitHub PoC
Pre-auth Local File Inclusion in WP User Manager <= 2.9.17 via path traversal in tab parameter (CVSS 7.5)
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
56RISK
open ↗GitHub PoC
bayu06802/CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
100RISK
open ↗GitHub PoC★ 1
CVE-2018-10933 - libssh Authentication Bypass
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client coul
85RISK
open ↗GitHub PoC
This repository contains a professional bug bounty report demonstrating the successful exploitation of a Blind SSRF vulnerability that reached an internal CGI endpoint vulnerable to Shellshock (CVE-2014-6271). Remote command execution was confirmed using an out-of-band (OAST) DNS callback, showcasing the complete attack chain, technical analysis.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC
Research and hands-on PoC of Spectre Variant 2 (CVE-2017-5715), a hardware side-channel vulnerability exploiting CPU speculative execution and branch prediction. Includes lab setup, vulnerability identification, exploit walkthrough, cache-timing analysis, demo video, and mitigation strategies.
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized discl
55RISK
open ↗GitHub PoC★ 2
Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated Stored Cross-Site Scripting Proof of Concept
Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter
33RISK
open ↗GitHub PoC
SLO-CYBER-SEC/CVE-2026-78850
An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / Sites
33RISK
open ↗GitHub PoC
Script de python para Webmin 1.996
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.
60RISK
open ↗GitHub PoC★ 4
PoC for CVE-2026-53360: guest-triggered heap out-of-bounds read/write in KVM SEV-SNP Page State Change (PSC) handling.
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
41RISK
open ↗GitHub PoC
Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).
NGINX Map directive and Regex matching vulnerability
48RISK
open ↗GitHub PoC★ 3
CVE-2026-54998 RCE Exploit
Microsoft Exchange Online Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC★ 2
PoC for CVE-2026-54415 — Azuriom CMS (<1.2.11) Broken Access Control → account takeover
Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover
41RISK
open ↗GitHub PoC★ 3
📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
100RISK
open ↗GitHub PoC★ 1
Python & template nuclei
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗GitHub PoC
Unauthenticated RCE in Langflow <1.9.0 (CVE-2026-33017) Exploit
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open ↗GitHub PoC★ 1
💉 Blind SQL Injection → RCE exploit for Control Web Panel (CWP) ≤ 0.9.8.1224 — userRes POST → INTO DUMPFILE → cwpsvc shell
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
48RISK
open ↗GitHub PoC
CVE-2026-59243 — Apache Airflow FAB Auth Manager JWT signature bypass (embargoed until Apache advisory)
Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
48RISK
open ↗GitHub PoC
Exploit for MCPJam Inspector - Remote Code Execution (CVE-2026-23744)
REC in MCPJam inspector due to HTTP Endpoint exposes
75RISK
open ↗GitHub PoC★ 2
CVE-2026-22874 writeup: incomplete SSRF allow-list in Gitea webhook/migration (IPv6 transition and cloud metadata). Fixed in Gitea 1.26.3.
Gitea webhook and migration allow-list filtering permits SSRF
48RISK
open ↗GitHub PoC★ 30
Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).
NGINX Map directive and Regex matching vulnerability
48RISK
open ↗GitHub PoC★ 1
caterscam/CVE-2026-5524-PoC
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
63RISK
open ↗GitHub PoC★ 4
Read-only vulnerability scanner for CVE-2026-49049 — Helix3 Joomla plugin unauthenticated AJAX handler
Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler
56RISK
open ↗GitHub PoC
PoC of Langflow CVE-2026-33017
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.