Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
16,340 exploits
GitHub PoC
CVE-2024-4367 PDF.js FontMatrix injection PoC (payload: alert(1)) - authorized pentest artifact
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js c
55RISK
open ↗GitHub PoC
CVE-2026-39987 Exploit | by infrar3d
marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
100RISK
open ↗GitHub PoC
CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISK
open ↗GitHub PoC★ 1
hhg69/CVE-2026-41875-EXPLOIT-QuickCart-one-click-Account-Takeover
Cross-Site Request Forgery in admin panel of Quick.Cart
33RISK
open ↗GitHub PoC
Ubuntu's node-braces plus the CVE-2026-93687 nesting-depth fix, for ppa:pillarsdotnet/ppa
braces through 3.0.3 Stack Overflow via Deeply Nested Patterns
41RISK
open ↗GitHub PoC
Controlled vulnerability assessment of Metasploitable 2, identifying and validating CVE-2011-2523 in vsftpd 2.3.4 within an isolated lab environment.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC
PoC and automated code to exploit CVE-2025-57819 in FreePBX. It demonstrates the Remote Code Execution (RCE) vulnerability via command injection in the Asterisk system. Ideal for HackTheBox environments.
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISK
open ↗GitHub PoC
Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only.
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
78RISK
open ↗GitHub PoC
CVE-2026-16444 — Arbitrary file write on the controller via TeamViewer Classical File Transfer (TV-2026-1008)
Improper Validation of File Paths in TeamViewer Desktop Clients
41RISK
open ↗GitHub PoC
tunahantekeoglu/CVE-2025-54769
KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal
41RISK
open ↗GitHub PoC
kashishtopi/CVE-2026-105314
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call
41RISK
open ↗GitHub PoC
r30xlqo6从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）w680rjb2afux
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
13RISK
open ↗GitHub PoC
Joomla 4.1.0 exploit
[20230201] - Core - Improper access check in webservice endpoints
100RISK
open ↗GitHub PoC
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
41RISK
open ↗GitHub PoC
CVE-2018-7600 (Drupalgeddon2) — Drupal RCE exploit tool. Standalone Python PoC for authorized security testing. CVSS 9.8 Critical. by K52-ai.
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi
100RISK
open ↗GitHub PoC
A Proof-of-Concept implementation for CVE-2025-55182, a critical unauthenticated Remote Code Execution vulnerability affecting React Server Components (RSC).
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
CVE-2026-72898 Metabase SQL injection lab with vulnerable and patched versions, admin session creation, CSV export, order deletion, and recovery.
Metabase SQL injection via password reset endpoint
100RISK
open ↗GitHub PoC
Hands-on cybersecurity and CTF labs covering service fingerprinting, MySQL enumeration, HTTP clues, SSH discovery, port probing, host discovery, ICA access paths, CVE-2026-13247 WordPress Stored XSS, Thales, and Tomcat security.
Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter
33RISK
open ↗GitHub PoC
CVE-2026-104991 — Missing Authorization (BOLA/IDOR) in Phproject REST API read/comment endpoints
Phproject < 1.8.7 Missing Authorization via Issues REST API
41RISK
open ↗GitHub PoC
CVE-2026-83627 — Hummingbird Performance <= 3.21.0 Unauthenticated RCE. Pure Python exploit. by K52-ai.
Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log
48RISK
open ↗GitHub PoC
A critical authentication bypass vulnerability in Fortinet products (FortiOS, FortiProxy, and FortiSwitchManager)
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
100RISK
open ↗GitHub PoC★ 1
CVE-2026-103355 - Unlimited Elements For Elementor <= 2.0.20 unauthenticated blind SQL injection via terms-listing identifiers (CVSS 9.3): Docker validation lab with vulnerable (2.0.20) vs patched (2.0.21) controls, read-only boolean-oracle PoC, nuclei version screen. Authorized security research only.
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
48RISK
open ↗GitHub PoC
TheJesterrrr/CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
63RISK
open ↗GitHub PoC
CVE-2026-92084 — Beaver Builder Lite <= 2.11.0.5 unauthenticated arbitrary shortcode execution via Sidebar module widget output (CVSS 9.1): Docker validation lab with vulnerable/patched controls, safe-oracle Python PoC, nuclei version screen. Authorized security research only.
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
48RISK
open ↗GitHub PoC★ 4
Proof-of-concept scanner and exploit helper for CVE-2026-14378: unauthenticated administrator session takeover in the WordPress plugin DevKit Pro (dplugins) through a flawed user-switch “revert” flow.
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
48RISK
open ↗GitHub PoC
Infrastructure penetration-testing lab demonstrating reconnaissance, CVE-2012-1823 exploitation, initial access, and privilege-escalation investigation.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
100RISK
open ↗GitHub PoC
An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).
The vmsplice_to_pipe function in Linux kernel 2.6.17 through 2.6.24.1 does not validate a certain userspace pointer befo
23RISK
open ↗GitHub PoC★ 1
Unauthenticated Privilege Escalation Mass Exploit Super Forms <= 6.3.316 CVE-2026-15989
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
98RISK
open ↗GitHub PoC
A python3 PoC for CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.