Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
84,600cataloged exploits
39,734CVEs with public exploitation
24,695lab-tested
AllReferência 25,742Exploit-DB 24,486GitHub PoC 16,618VulnCheck XDB 9,736Nuclei 4,493Metasploit 3,525✓ verified onlyrecentpopularrisk
16,343 exploits
GitHub PoC
CVE-2026-79417 PoC
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privile
33RISK
open ↗GitHub PoC
Samba 3.0.20 username map script command injection exploit — reverse shell via SMB authentication, built from scratch in Python using impacket. No Metasploit.
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗GitHub PoC
Unauthenticated IDOR in Bookly ≤ 28.2: bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC — pocbit.org/pocs/cve-2026-93399
Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
48RISK
open ↗GitHub PoC
Penetration testing report and PoC on Metasploitable2 target, demonstrating CVE-2011-2523 vsFTPd v2.3.4 exploitation via Metasploit.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC★ 4
MikroTik RouterOS PoC Collection - CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISK
open ↗GitHub PoC
Benign, self-contained reproduction of CVE-2026-61732 (Decepticon ChatML role-boundary forgery)
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
48RISK
open ↗GitHub PoC★ 1
CVE-2026-86350 - Apache Tomcat - Critical 9.1 - Unauthenticated GET /header.jsp - HTTP/2 Request Header Mix-up (Request Smuggling)
Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
48RISK
open ↗GitHub PoC
LetsDefend SOC lab investigating CVE-2024-49138 exploitation and related malicious activity.
Windows Common Log File System Driver Elevation of Privilege Vulnerability
76RISK
open ↗GitHub PoC★ 64
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
41RISK
open ↗GitHub PoC
CVE-2026-65660 - Draft or TODO
Microsoft SharePoint Server Remote Code Execution Vulnerability
71RISK
open ↗GitHub PoC★ 4
Unauthenticated privilege escalation in WordPress WAWP (Automation Web Platform) ≤ 4.8.6 via public REST signup and unsanitized wawp_custom_fields → admin. Python check/exploit PoC (PoCbit).
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
48RISK
open ↗GitHub PoC
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
WordPress CVE-2026-87902 diagnostic check
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
jvidhan/cve-2026-43687
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadO
33RISK
open ↗GitHub PoC★ 5
针对 OnePlus Ace6 设备的 cve-2026-64560 复现
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISK
open ↗GitHub PoC★ 1
CVE-2026-62062 - WordPress - Elementor Website Builder - High 8.8 - Unauthenticated POST /?rest_route=/wp/v2/users&x=elementor... - Cross-Site Request Forgery to Administrator Account Creation
WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
41RISK
open ↗GitHub PoC
WP Plainview Activity Monitor auth RCE fix: broken manual cookie parse to stable Session handling. CVE-2018-15877 educational fix.
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell meta
60RISK
open ↗GitHub PoC★ 4
CVE-2026-64560 toolkit: Go single-binary toolchain + realme RMX5010 (A16, SM8750) target port
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
41RISK
open ↗GitHub PoC★ 2
CVE-2026-5430 - WSO2 API Manager - Critical 10.0 - Unauthenticated Account Takeover - WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic Manager, WSO2 Universal Gateway
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
78RISK
open ↗GitHub PoC
Lab vulnerável (Docker) + PoC Python para a CVE-2026-87902 — path traversal não autenticado no WordPress Core (page-template -> LFI -> RCE condicional). Uso educacional/autorizado.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC★ 1
Malicious Register Directive Code Injection Exploit
Microsoft SharePoint Server Remote Code Execution Vulnerability
71RISK
open ↗GitHub PoC
technical research & analysis on linux process execution, SUID privilege escalation, LD_PRELOAD hooking, and CVE-2014-6271 (shellshock).
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC★ 3
Proof of concept for vulnerability CVE-2026-87902 in Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Unauthenticated authorization bypass in Customer Reviews for WooCommerce ≤ 5.120.0: holders of a public /cusrev/{formId}/ review link can POST cr_local_forms_submit with arbitrary Media Library attachment IDs in items[].media. Linked files are permanently deleted when the review comment is purged. Python check/exploit PoC (PoCbit catalog).
Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
48RISK
open ↗GitHub PoC
PoC for CVE-2026-72001 — Pangolin < 1.22.0 cross-organization resource authentication bypass via the share-link access-token endpoint (CWE-639, CVSS 8.1).
Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint
41RISK
open ↗GitHub PoC
zyphorixofficialmain-lab/cve-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
CVE-2026-94609: Writeup and POC
authentik: Privilege Escalation to Superuser via Group Hierarchy
41RISK
open ↗GitHub PoC★ 40
Technical disclosure and PoC for CVE-2026-84543, a macOS SMB kernel vulnerability
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27,
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.