Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,634cataloged exploits

40,286CVEs with public exploitation

24,696lab-tested

All Referência 26,110Exploit-DB 24,488GitHub PoC 17,941VulnCheck XDB 10,016Nuclei 4,547Metasploit 3,532✓ verified onlyrecent popular risk

17,941 exploits

GitHub PoC

An advanced exploit for Microsoft Exchange Server (CVE-2021-26855, CVE-2021-27065) enhanced with Convergent Time Theory principles, achieving near-perfect theoretical rating through quantum temporal resonance and α-dispersion techniques.

CVE-2021-26855CRITICALunder attackransomware27 Jan 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

100RISK

GitHub PoC

androidteacher/CVE-2024-50498-wpquery

CVE-2024-50498CRITICAL27 Jan 2026

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

75RISK

GitHub PoC

Payload CVE-2026-24061

CVE-2026-24061CRITICALunder attack27 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

Simple and effective PoC for CVE-2021-43798 Grafana Path Traversal

CVE-2021-43798HIGHunder attack27 Jan 2026

Grafana path traversal

100RISK

GitHub PoC★ 1

0xLittleSpidy/CVE-2025-54309

CVE-2025-54309CRITICALunder attack27 Jan 2026

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and

100RISK

GitHub PoC★ 1

Telnetd Auth Bypass Scanner (CVE-2026-24061) A Python-based scanner for detecting and exploiting the CVE-2026-24061 vulnerability in GNU Inetutils telnetd services. This tool scans IP addresses or networks for vulnerable telnetd services that allow authentication bypass leading to root shell access.

CVE-2026-24061CRITICALunder attack27 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC★ 4

This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components

CVE-2025-55182CRITICALunder attackransomware27 Jan 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

GitHub PoC

Looking at current high-impact vulnerabilities, let's use the VMware vCenter Server CVE-2021-21972 (CVSS 9.8) as our base. This is a publicly known RCE with patches available, perfect for demonstrating CTT enhancements.

CVE-2021-21972CRITICALunder attackransomware27 Jan 2026

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor

100RISK

GitHub PoC

Sn0wBaall/CVE-2024-23334-PoC

CVE-2024-23334MEDIUM27 Jan 2026

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

70RISK

GitHub PoC★ 1

CVE-2025-24893 | Vulnérabilité d'exécution de code à distance sur la plateforme XWiki (preuve de concept)

CVE-2025-24893CRITICALunder attack26 Jan 2026

Remote code execution as guest via SolrSearchMacros request in xwiki

100RISK

GitHub PoC★ 1

A Proof of Concept for CVE-2025-29927 demonstrating a middleware bypass in Next.js versions prior to 13.5.9

CVE-2025-29927CRITICAL26 Jan 2026

Authorization Bypass in Next.js Middleware

85RISK

GitHub PoC

Spring Cloud Gateway SpEL RCE Vulnerability Environment

CVE-2025-41243CRITICAL26 Jan 2026

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

63RISK

GitHub PoC

punitdarji/telnetd-cve-2026-24061

CVE-2026-24061CRITICALunder attack26 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

🔍 Analyze WebKit and ANGLE vulnerabilities with this repository for CVE-2025-43529 and CVE-2025-14174, focusing on verified components and ongoing efforts.

CVE-2025-43529HIGHunder attack26 Jan 2026

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

76RISK

GitHub PoC

afifudinmtop/CVE-2009-3103

CVE-2009-3103—26 Jan 2026

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Window

60RISK

GitHub PoC

Vulnerability in GNU InetUtils telnetd Enables Remote Root Access

CVE-2026-24061CRITICALunder attack26 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC★ 17

CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具

CVE-2026-24061CRITICALunder attack26 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

CVE-2026-24061-Scanner by XsanLahci

CVE-2026-24061CRITICALunder attack26 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

ms0x08-dev/CVE-2026-24061-POC

CVE-2026-24061CRITICALunder attack25 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

CVE-2025-60021

CVE-2025-60021CRITICAL25 Jan 2026

Apache bRPC: Remote command injection vulnerability in heap builtin service

53RISK

GitHub PoC

CVE-2025-64155

CVE-2025-64155CRITICAL25 Jan 2026

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

60RISK

GitHub PoC

Baza-NATO/CVE-2021-33044

CVE-2021-33044CRITICALunder attack25 Jan 2026

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

100RISK

GitHub PoC

Python demo simulating CVE-2024-3094: a supply chain backdoor in XZ Utils with a trigger-based stealth activation.

CVE-2024-3094CRITICAL25 Jan 2026

Xz: malicious code in distributed source

70RISK

GitHub PoC★ 2

This script exploits an SQL Injection vulnerability in WordPress Quiz Maker plugin (≤ 6.7.0.56) by injecting payloads via an HTTP header (default: X-Forwarded-For).

CVE-2025-10042MEDIUM25 Jan 2026

Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection

33RISK

GitHub PoC

dionissh/CVE-2024-21413

CVE-2024-21413CRITICALunder attack25 Jan 2026

Microsoft Outlook Remote Code Execution Vulnerability

100RISK

GitHub PoC

CVE-2026-21876 OWASP ModSecurity CRS WAF bypass (docker container + minimal PoC).

CVE-2026-21876CRITICAL25 Jan 2026

OWASP CRS has multipart bypass using multiple content-type parts

53RISK

GitHub PoC

jagg3rsec/CVE-2014-6287

CVE-2014-6287CRITICALunder attack25 Jan 2026

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

100RISK

GitHub PoC★ 1

CVE-2026-24061 PoC

CVE-2026-24061CRITICALunder attack25 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

CVE-2026-24061

CVE-2026-24061CRITICALunder attack25 Jan 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC★ 3

CVE-2015-2291 Local Privilege Escalation PoC

CVE-2015-2291HIGHunder attackransomware25 Jan 2026

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows all

76RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.