Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,056cataloged exploits
40,804CVEs with public exploitation
24,696lab-tested
AllReferência 26,494Exploit-DB 24,489GitHub PoC 18,351VulnCheck XDB 10,605Nuclei 4,578Metasploit 3,539✓ verified onlyrecentpopularrisk
88,056 exploits
GitHub PoC
Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥
Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter
48RISK
open ↗GitHub PoC
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
41RISK
open ↗GitHub PoC★ 9
CVE-2026-85706 Unauthenticated File Read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗GitHub PoC
Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection POC
ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id
41RISK
open ↗GitHub PoC
Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
41RISK
open ↗GitHub PoC★ 1
CVE-2004-2687 (Distcc 3.2.1) exploitation, methodology & remediation — Metasploitable2 lab
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at
60RISK
open ↗GitHub PoC
SecDim Challenge Builder repro inspired by CVE-2026-88861: AAL1 MFA bypass at privileged credential boundary
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
41RISK
open ↗GitHub PoC★ 1
End-to-end recon and exploitation of a known backdoor (CVE-2010-2075) on Metasploitable2 using Nmap and Metasploit.
UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally
60RISK
open ↗VulnCheck XDB
initial-access
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗GitHub PoC★ 2
CVE-2026-85706_docker_exp
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗VulnCheck XDB
local
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗VulnCheck XDB
initial-access
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗VulnCheck XDB
initial-access
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open ↗VulnCheck XDB
initial-access
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗VulnCheck XDB
initial-access
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
PoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗VulnCheck XDB
initial-access
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
63RISK
open ↗VulnCheck XDB
info-leak
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗VulnCheck XDB
info-leak
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
56RISK
open ↗GitHub PoC★ 88
🛡️ Official AI Security Tool module for CVE-2026-54121 (Certighost - AD CS Domain Controller Impersonation & PKINIT Elevation).
Active Directory Certificate Services Elevation of Privilege Vulnerability
41RISK
open ↗GitHub PoC
ivanesk315/CVE-2026-28496
FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
63RISK
open ↗GitHub PoC
CVE-2016-3223 - Draft or TODO
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold an
28RISK
open ↗VulnCheck XDB
remote-with-credentials
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as
83RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC★ 5
SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code in
71RISK
open ↗GitHub PoC
ethicbrudhack/CVE-2008-0166-BTC-satoshi-mining-wallets
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that ge
45RISK
open ↗GitHub PoC
vudangducminh/CVE-2022-0847
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in cop
100RISK
open ↗GitHub PoC
ivanesk315/CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
75RISK
open ↗GitHub PoC
Jasper2018/CVE-2018-20062
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP
100RISK
open ↗GitHub PoC★ 1
Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.