Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,150cataloged exploits
39,601CVEs with public exploitation
24,695lab-tested
AllReferência 25,629Exploit-DB 24,485GitHub PoC 16,343VulnCheck XDB 9,680Nuclei 4,488Metasploit 3,525✓ verified onlyrecentpopularrisk
16,343 exploits
GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96878.
Cargo Exhibit field alias allows stored XSS
33RISK
open ↗GitHub PoC
A detection/hunting script for compromise related to CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
78RISK
open ↗GitHub PoC
CVE-2026-101108 PoC: OrdaSoft Joomla Vehicle Manager (Free) <=6.5.7 unauth SQLi — order_field/order_direction unquoted ORDER BY (com_vehiclemanager). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101108
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8
48RISK
open ↗GitHub PoC
CVE-2026-100752 PoC: OrdaSoft Joomla Real Estate Manager (Free) <=6.7.8 unauth SQLi via order_field ORDER BY (com_realestatemanager). Colored check + mass exploit, version fingerprint, PoCbit https://pocbit.org/pocs/cve-2026-100752
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
48RISK
open ↗GitHub PoC
Sanitized UploadWizard report and patch verification notes for CVE-2026-100381.
UploadWizard Flickr collection and set titles allow DOM XSS
33RISK
open ↗GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96876.
Anonymous reflected XSS in CargoExport invalid-alias errors
33RISK
open ↗GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96877.
Reflected XSS through Cargo Drilldown full-text search
33RISK
open ↗GitHub PoC
ChinaRan0/CVE-2026-59310-POC 的优化版本。子命令、一次性 cron、带远端 PTY 的交互 shell。仅限授权测试。
vCenter directory-traversal vulnerability
78RISK
open ↗GitHub PoC
Sanitized Wikibase report and patch verification notes for CVE-2026-100380.
Reflected XSS in Wikibase Special:SetLabel language validation
33RISK
open ↗GitHub PoC★ 1
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all
48RISK
open ↗GitHub PoC
CVE-2026-8065 PoC: Hitachi Energy RTU500 unauth firmware update bypass (CWE-306, CVSS 9.1). IoT/OT colored check + mass exploit — RTU500 fingerprint, firmware endpoint probe, lab-safe upload test. https://pocbit.org/pocs/cve-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions all
48RISK
open ↗GitHub PoC
CVE-2026-101110 PoC: OrdaSoft Joomla Book Library (Free) <=6.4.6 unauth SQLi — field/direction ORDER BY, session prime + `-- xselect` blacklist bypass (com_booklibrary). Colored check + mass exploit, CVSS 9.3. https://pocbit.org/pocs/cve-2026-101110
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
48RISK
open ↗GitHub PoC
Published Epson EH-TW5350 CVE · Firmware update verification bypass · B-BEAM-BOB team
Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector
48RISK
open ↗GitHub PoC
kiyingiericmark-wq/CVE-2020-24186
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo
85RISK
open ↗GitHub PoC
Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection
48RISK
open ↗GitHub PoC
Sanitized WikiLambda report and patch verification notes for CVE-2026-96872.
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
28RISK
open ↗GitHub PoC★ 1
PoC / Exploit for CVE-2025-32463(sudo LPE)
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director
100RISK
open ↗GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96874.
Stored XSS in Cargo Drilldown tab names
28RISK
open ↗GitHub PoC
https://vuldb.com/cve/CVE-2026-102261
owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
33RISK
open ↗GitHub PoC★ 6
XWP_RCE — CVE-2026-87902 Hacker Console
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Published SiYuan CVE · Reporter: dpfkdlemtp · Official record and advisory links
SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations
41RISK
open ↗GitHub PoC
Sanitized CirrusSearch report and patch verification notes for CVE-2026-96873.
Reflected XSS in CirrusSearch debug explain output
33RISK
open ↗GitHub PoC
CVE-2025-24813 Apache Tomcat 11 1-day vulnerability research lab
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISK
open ↗GitHub PoC★ 9
Docker lab for validating CVE-2026-84383 in libheif through Discourse
libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
48RISK
open ↗GitHub PoC
CVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
48RISK
open ↗GitHub PoC
Published Epson EH-TW5350 CVE · Web Control authentication bypass · B-BEAM-BOB team
An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malici
33RISK
open ↗GitHub PoC
Hasyros/CVE-2026-101160-dos-wp-ultimate-review-rating
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
41RISK
open ↗GitHub PoC★ 28
ZeroDayEvil/CVE-2026-41940-PoC
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.