Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

84,600cataloged exploits

39,734CVEs with public exploitation

24,695lab-tested

All Referência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecent popular risk

16,343 exploits

GitHub PoC★ 2

Laboratorio pedagógico de CVE-2026-93485 (Comment2Shell): stored XSS no autenticado en WordPress core vía wpautop -> RCE, con demo del root cause auto-verificada, control 7.1.1 y la vía Post2Shell

CVE-2026-93485HIGH26 Sep 2026

WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

41RISK

GitHub PoC★ 1

Unauthenticated arbitrary file upload on Honeywell PD45 web admin (firmware F10.19.010040–before F10.22.030745) leading to RCE. Python check/exploit PoC

CVE-2026-13249CRITICAL26 Sep 2026

Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

48RISK

GitHub PoC

Farih123/CVE-2026-90817

CVE-2026-90817CRITICAL26 Sep 2026

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce

48RISK

GitHub PoC

CVE-2026-61500 Rejetto HFS predictable PRNG session forgery to RCE PoC and Docker lab

CVE-2026-61500CRITICAL26 Sep 2026

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

48RISK

GitHub PoC★ 1

AcyMailing Enterprise for Joomla < 11.1.0: POP3 mailbox actions save MIME attachments without extension checks to media/com_acym/upload/, enabling RCE when an attacker can email the monitored inbox (CVE-2026-94132, CVSS 9.5). Python check/exploit PoC —

CVE-2026-94132CRITICAL26 Sep 2026

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

48RISK

GitHub PoC

Read-only check of every WordPress core version on a server. Flags CVE-2026-87902 (fixed in 7.1.2 and backports), auto-updates turned off, and published attack indicators.

CVE-2026-87902HIGHunder attack26 Sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RISK

GitHub PoC

CVE-2026-97163 PoC payload (UP plugin Joomla remote code installation)

CVE-2026-97163CRITICAL26 Sep 2026

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

48RISK

GitHub PoC

A tool for exploiting CVE-2026-41940, a critical authentication bypass in cPanel & WHM (CVSS 10.0), allowing unauthenticated attackers to gain root-level WHM access by injecting CRLF sequences into server-side session files via the Authorization header — no credentials required.

CVE-2026-41940CRITICALunder attackransomware26 Sep 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISK

GitHub PoC

CVE-2026-87902

CVE-2026-87902HIGHunder attack26 Sep 2026

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

98RISK

GitHub PoC

Docker-based educational lab for CVE-2021-44228 (Log4Shell)

CVE-2021-44228CRITICALunder attackransomware26 Sep 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC★ 1

Unauthenticated SQL injection in Joomla YouTube Gallery (joomlaboat.com, com_youtubegallery) ≤ 5.7.2 — video search/sort on the public yg_api endpoint. Python check/exploit PoC for CVE-2026-94130 — PoCbit.

CVE-2026-94130CRITICAL26 Sep 2026

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3

48RISK

GitHub PoC★ 1

CVE-2026-14281

CVE-2026-14281CRITICAL26 Sep 2026

Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

48RISK

GitHub PoC★ 2

Tracking the QEMU CVE-2026-93834 9pfs fid-path use-after-free guest-to-host escape

CVE-2026-93834HIGH26 Sep 2026

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

41RISK

GitHub PoC★ 1

CVE-2026-97163 PoC: Joomla UP (lomart.fr) unauthenticated GitHub mini-install / remote action deployment (≤6.0.29). Detects plugin version, probes com_ajax install triggers. Fix: UP 6.1.0 / 5.2.1. https://pocbit.org/pocs/cve-2026-97163

CVE-2026-97163CRITICAL26 Sep 2026

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

48RISK

GitHub PoC★ 1

CVE-2026-29053 - Ghost CMS < 6.19.0 - Authenticated Remote Code Execution via Malicious Theme

CVE-2026-29053HIGH26 Sep 2026

Ghost Vulnerable to Remote Code Execution via Malicious Themes

56RISK

GitHub PoC

Bookly <= 28.2 Unauth IDOR + PII Leak + RCE Mass exploitation scanner for CVE-2026-93399 (CVSS 9.1 Critical) affecting the Bookly — Online Scheduling and Appointment Booking System WordPress plugin (versions <= 28.2).

CVE-2026-93399CRITICAL26 Sep 2026

Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

48RISK

GitHub PoC

CVE-2026-97161 PoC: Joomla UP (lomart.fr) unauthenticated path traversal / arbitrary file read via ajax-view (≤6.0.29). Fingerprints plugin, probes configuration.php. Fix: UP 6.1.0 / 5.2.1. https://pocbit.org/pocs/cve-2026-97161

CVE-2026-97161CRITICAL26 Sep 2026

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

48RISK

GitHub PoC

CVE-2026-97163 PoC payload (UP plugin Joomla remote code installation)

CVE-2026-97163CRITICAL26 Sep 2026

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

48RISK

GitHub PoC

CVE-2026-82901 PoC: WordPress Ultra Addons for Contact Form 7 ≤3.5.50 unauth file upload via signature field when PDF Generator is enabled → wp-content/uploads/uacf7-uploads/. Fix: 3.5.51+. https://pocbit.org/pocs/cve-2026-82901

CVE-2026-82901CRITICAL26 Sep 2026

Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

48RISK

GitHub PoC★ 1

CVE-2026-15583 - Grafana MCP Server - High 8.6 - Unauthenticated POST /mcp - Unauthenticated Token Exfiltration (X-Grafana-URL Confused Deputy)

CVE-2026-15583HIGH26 Sep 2026

SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

41RISK

GitHub PoC

CVE-2020-14008 - ManageEngine Applications Manager RCE

CVE-2020-14008—26 Sep 2026

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in

35RISK

GitHub PoC

Unauthenticated arbitrary file upload in Addify Request a Quote for WooCommerce ≤ 2.9.2 via public AJAX afrfq_submit_quote_via_popup — unsafe move_uploaded_file() with attacker-controlled .php filenames into web-accessible RFQ temp storage (popup quote flow required). CVSS 9.8. Python check/exploit PoC → pocbit.org/pocs/cve-2026-18143

CVE-2026-18143CRITICAL26 Sep 2026

Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

63RISK

GitHub PoC

CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)

CVE-2026-48356CRITICAL26 Sep 2026

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

48RISK

GitHub PoC★ 1

langz337/CVE-2026-63030

CVE-2026-63030CRITICALunder attack26 Sep 2026

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

98RISK

GitHub PoC

Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka

CVE-2026-15911HIGH26 Sep 2026

Confluent Kafka Python Improper TLS Certificate Validation

41RISK

GitHub PoC★ 10

OnePlus Ace 6 temporary root tool (CVE-2026-64560) - device-verified port with corrected bootidParent address

CVE-2026-64560HIGH26 Sep 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

GitHub PoC★ 4

MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing

CVE-2026-67279MEDIUMunder attack26 Sep 2026

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

63RISK

GitHub PoC

CVE-2026-75650 - Magento Open Source - Critical 10.0 - Unauthenticated POST /graphql - Unauthenticated Remote Code Execution (StyleSmuggler SSTI)

CVE-2026-75650CRITICALunder attack26 Sep 2026

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

78RISK

GitHub PoC★ 4

MikroTik RouterOS PoC Collection - CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH

CVE-2026-86060CRITICALunder attack25 Sep 2026

SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

78RISK

GitHub PoC★ 5

针对 OnePlus Ace6 设备的 cve-2026-64560 复现

CVE-2026-64560HIGH25 Sep 2026

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

41RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.