Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,508cataloged exploits

40,258CVEs with public exploitation

24,696lab-tested

All Referência 26,095Exploit-DB 24,488GitHub PoC 17,831VulnCheck XDB 10,015Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

17,831 exploits

GitHub PoC

A POC chain exploit using the recent Cisco SMP exploit (CVE-2017-6736) to chain into Spectre (CVE-2017-5753 and CVE-2017-5715)

CVE-2017-6736HIGHunder attack11 Feb 2026

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabiliti

93RISK

open ↗

GitHub PoC

Wise-Security/CVE-2025-69600

CVE-2025-69600HIGH11 Feb 2026

Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execut

41RISK

open ↗

GitHub PoC★ 4

This program Prompts you for the Local File Inclusion information and will automatically search the /etc/passwd and using the users names found will search for and download any SSH key or variation of keys to the local computer. This program also performs the CVE-2021-41773_ apache2.4.49 and 50 traversal path exploit. In addtion to other LFI Vuln

CVE-2021-41773HIGHunder attackransomware11 Feb 2026

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

100RISK

open ↗

GitHub PoC

PowerShell remediation for CVE-2013-3900 (WinVerifyTrust) / Tenable Plugin 166555 using EnableCertPaddingCheck.

CVE-2013-3900MEDIUMunder attack11 Feb 2026

WinVerifyTrust Signature Validation Vulnerability

75RISK

open ↗

GitHub PoC★ 1

Ni8mare, n8n RCE

CVE-2026-21858CRITICAL11 Feb 2026

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

85RISK

open ↗

GitHub PoC

IsmaelCosma/CVE-2025-8088

CVE-2025-8088HIGHunder attackransomware11 Feb 2026

Path traversal vulnerability in WinRAR

93RISK

open ↗

GitHub PoC★ 3

PoC exploit for CVE-2025-49132 (GHSA-24wv-6c99-f843) – Unauthenticated Remote Code Execution in Pterodactyl Panel ≤ 1.11.10

CVE-2025-49132CRITICAL11 Feb 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

GitHub PoC

CVE-2025-6018 (pam LPE unpriv->allow_active), CVE-2025-6019 (udisks LPE allow_active->root) in sh

CVE-2025-6018HIGH11 Feb 2026

Pam-config: lpe from unprivileged to allow_active in pam

41RISK

open ↗

GitHub PoC

lockbitblack-ai/CVE-2024-4577-new

CVE-2024-4577CRITICALunder attackransomware11 Feb 2026

Argument Injection in PHP-CGI

100RISK

open ↗

GitHub PoC

This is a modified version of the time-based SQL injection exploit for CMS Made Simple <= 2.2.9. The exploit was originally created by Daniele Scanu and has been updated for better compatibility and modern Python practices.

CVE-2019-9053—11 Feb 2026

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve

35RISK

open ↗

GitHub PoC

openshift rce poc

CVE-2024-7387CRITICAL11 Feb 2026

Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy

48RISK

open ↗

GitHub PoC

Ahmedf000/CVE-2025-49132_HTB_SEASON10

CVE-2025-49132CRITICAL11 Feb 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

GitHub PoC

Cisco iOS SNMP Overflow Exploit Toolkit (CVE-2017-6736)

CVE-2017-6736HIGHunder attack11 Feb 2026

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabiliti

93RISK

open ↗

GitHub PoC★ 1

This script exploits Remote Code Execution vulnerability in Pterodactyl Panel < 1.11.11

CVE-2025-49132CRITICAL11 Feb 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

GitHub PoC

faysalferdous/CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability

CVE-2025-68645HIGHunder attack10 Feb 2026

A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1

98RISK

open ↗

GitHub PoC★ 1

Enumeration tool for CVE-2024-45440

CVE-2024-45440MEDIUM10 Feb 2026

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash

48RISK

open ↗

GitHub PoC★ 1

CVE-2025-49132: Pterodactyl Panel UnauthN LFI to RCE (w/ pearcmd) in posix sh

CVE-2025-49132CRITICAL10 Feb 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

GitHub PoC★ 1

George0Papasotiriou/CVE-2025-61882-Oracle-BI-Publisher-RCE

CVE-2025-61882CRITICALunder attackransomware10 Feb 2026

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integratio

100RISK

open ↗

GitHub PoC

bixiPRO/Drupalgeddon2-CVE-2018-7600

CVE-2018-7600CRITICALunder attackransomware10 Feb 2026

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbi

100RISK

open ↗

GitHub PoC★ 4

Auto exploit for CVE-2025-6018 & CVE-2025-6019 based on https://github.com/0rionCollector/Exploit-Chain-CVE-2025-6018-6019

CVE-2025-6018HIGH10 Feb 2026

Pam-config: lpe from unprivileged to allow_active in pam

41RISK

open ↗

GitHub PoC

bananoname/CVE-2024-6386-WPML-SSTI

CVE-2024-6386CRITICAL10 Feb 2026

WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

53RISK

open ↗

GitHub PoC★ 2

SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks # (using INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and do not perform any signature or integrity # validation on the downloaded installer.

CVE-2026-25961HIGH10 Feb 2026

SumatraPDF Update MITM -> Arbitrary Code Execution

41RISK

open ↗

GitHub PoC

RCE on Next 16.0.6

CVE-2025-55182CRITICALunder attackransomware10 Feb 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 1

George0Papasotiriou/CVE-2025-59470-PostgreSQL-Command-Injection

CVE-2025-59470CRITICAL10 Feb 2026

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a mal

48RISK

open ↗

GitHub PoC★ 1

George0Papasotiriou/CVE-2025-55182-React2Shell-CVSS-10.0-

CVE-2025-55182CRITICALunder attackransomware10 Feb 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 3

CVE-2025-54253 | CVE-2025-54254 | Adobe Experience Manager Forms XXE → RCE Framework

CVE-2025-54253CRITICALunder attack10 Feb 2026

Adobe Experience Manager | Incorrect Authorization (CWE-863)

100RISK

open ↗

GitHub PoC★ 1

George0Papasotiriou/CVE-2025-8110-Gogs-Remote-Code-Execution

CVE-2025-8110HIGHunder attack10 Feb 2026

File overwrite in file update API in Gogs

100RISK

open ↗

GitHub PoC★ 1

George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE

CVE-2025-15556HIGHunder attack10 Feb 2026

Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

71RISK

open ↗

GitHub PoC

Laboratorio criado para PenTest da Vuln CVE 2024-214113(MONIKER LINK).

CVE-2024-21413CRITICALunder attack10 Feb 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RISK

open ↗

GitHub PoC★ 3

George0Papasotiriou/CVE-2025-14174-Chrome-Zero-Day

CVE-2025-14174HIGHunder attack10 Feb 2026

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfor

83RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.