Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

88,162cataloged exploits

40,894CVEs with public exploitation

24,696lab-tested

All Referência 26,559Exploit-DB 24,489GitHub PoC 18,385VulnCheck XDB 10,605Nuclei 4,584Metasploit 3,540✓ verified onlyrecent popular risk

88,162 exploits

GitHub PoC★ 2

HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.

CVE-2026-49975HIGH13 Jun 2026

Apache HTTP Server: mod_http2 denial of service

53RISK

open ↗

GitHub PoC

webshellseo8/CVE-2026-1555-POC

CVE-2026-1555CRITICAL13 Jun 2026

WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload

48RISK

open ↗

GitHub PoC

CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.

CVE-2018-9276HIGHunder attack13 Jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RISK

open ↗

GitHub PoC

Remote Code Execution in DbGate via functionName injection in the loadReader endpoint — CVSS 8.8

CVE-2026-48017HIGH13 Jun 2026

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

41RISK

open ↗

GitHub PoC

Some labs looking at the xz backdoor vulnerability (CVE-2024-3094)

CVE-2024-3094CRITICAL13 Jun 2026

Xz: malicious code in distributed source

70RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALunder attack13 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

open ↗

GitHub PoC

A lightweight stdio-based MCP server for local file system operations — read, write, edit, search, exec for AI assistants. Specially optimized for Chatbox: bat-bypass for exec (CVE-2026-6130), b64 encoding to eliminate escaping issues, and multi-pattern regex for precise code block targeting.

CVE-2026-6130MEDIUM13 Jun 2026

chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection

33RISK

open ↗

GitHub PoC★ 2

CVE-2021-21425 - GravCMS 1.10.7 Unauthenticated RCE via Scheduler. Improved exploit with CLI args and auto base64 encoding.

CVE-2021-21425CRITICAL13 Jun 2026

Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

85RISK

open ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-25243HIGH13 Jun 2026

redis-server RESTORE invalid memory access may allow remote code execution

41RISK

open ↗

GitHub PoC★ 1

ExifTool arbitrary code execution via a crafted DjVu image (versions 7.44 to 12.23). PoC builds a pure DjVu payload with djvumake, so the attacker machine needs no vulnerable ExifTool.

CVE-2021-22204MEDIUMunder attack13 Jun 2026

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

100RISK

open ↗

VulnCheck XDB

local

CVE-2021-4034HIGHunder attackransomware13 Jun 2026

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALunder attackransomware13 Jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC

JupyterHub XSRF bypass via cross-origin form POST (Sec-Fetch-Mode: no-cors) — CWE-352

CVE-2026-40864MEDIUM13 Jun 2026

JupyterHub: Cross-origin form POSTs bypass XSRF

33RISK

open ↗

GitHub PoC

CyruxSec/CVE-2026-4524

CVE-2026-4524MEDIUM13 Jun 2026

Authentication Bypass Using an Alternate Path or Channel in GitLab

33RISK

open ↗

GitHub PoC

CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.

CVE-2018-9276HIGHunder attack13 Jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RISK

open ↗

GitHub PoC

CVE-2025-55182 exploit script

CVE-2025-55182CRITICALunder attackransomware13 Jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-6279

CVE-2026-6279CRITICAL13 Jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

63RISK

open ↗

GitHub PoC★ 3

HTTP/2 Bomb (CVE-2026-49975) non-destructive vulnerability detector for Nginx / Apache httpd. Zero-dependency Python.

CVE-2026-49975HIGH13 Jun 2026

Apache HTTP Server: mod_http2 denial of service

53RISK

open ↗

GitHub PoC★ 1

HTTP/2 Bomb: HPACK indexed-reference amplification + flow-control stall. A high school student's full protocol analysis (LaTeX). CVE-2026-49975, CVE-2026-47774.

CVE-2026-49975HIGH13 Jun 2026

Apache HTTP Server: mod_http2 denial of service

53RISK

open ↗

VulnCheck XDB

remote-with-credentials

CVE-2018-9276HIGHunder attack13 Jun 2026

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administra

100RISK

open ↗

GitHub PoC★ 1

CVE-2026-45447

CVE-2026-45447HIGH13 Jun 2026

Heap Use-After-Free in the PKCS7_verify() Function

41RISK

open ↗

GitHub PoC

87achrafg-stack/CVE-2026-6279

CVE-2026-6279CRITICAL13 Jun 2026

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

63RISK

open ↗

GitHub PoC

Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

CVE-2026-8809CRITICAL12 Jun 2026

Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

48RISK

open ↗

GitHub PoC★ 3

CVE-2026-25089

CVE-2026-25089CRITICALunder attack12 Jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RISK

open ↗

VulnCheck XDB

initial-access

CVE-2025-55182CRITICALunder attackransomware12 Jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 4

Toolkit for CVE-2025-55182, also known as React2Shell.

CVE-2025-55182CRITICALunder attackransomware12 Jun 2026

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1

100RISK

open ↗

GitHub PoC★ 1

Chains CVE-2025-57819 (stacked query SQL injection) and CVE-2025-61678 (authenticated file upload in FreePBX Endpoint Manager) to achieve Remote Code Execution (RCE). For educational use only.

CVE-2025-57819CRITICALunder attack12 Jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

open ↗

Metasploit600

SimpleHelp OIDC Authentication Bypass Remote Code Execution

CVE-2026-48558CRITICALunder attack12 Jun 2026

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

100RISK

open ↗

GitHub PoC★ 4

CVE-2026-35273

CVE-2026-35273CRITICALunder attackransomware12 Jun 2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mana

100RISK

open ↗

GitHub PoC

rootdirective-sec/CVE-2026-46645-Analysis-Lab

CVE-2026-46645MEDIUM12 Jun 2026

SQLAdmin: Authorization Bypass on `ajax_lookup`

33RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.