Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
88,861cataloged exploits
40,956CVEs with public exploitation
24,696lab-tested
AllReferência 26,571Exploit-DB 24,489GitHub PoC 18,436VulnCheck XDB 11,241Nuclei 4,584Metasploit 3,540✓ verified onlyrecentpopularrisk
88,863 exploits
GitHub PoC★ 9
cPanel/WHM Authentication Bypass (Zero-Day Vulnerability)
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC★ 63
XsanFlip/poc-cpanel-cve-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Exploitation of CVE-2023-44604. Using a Kali Linux VM (attacker) and a Debian 11 server VM (victim)
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
open ↗GitHub PoC
Pre-Auth RCE in ProFTPD via mod_sql is_escaped_text() bypass (CVE-2026-42167)
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where th
56RISK
open ↗GitHub PoC★ 1
CVE-2026-31431 (copy.fail) — adapted for constrained Java execution environments via FFM syscall layer + javac annotation processor delivery
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC
CVE-2026-31431 mitigation (Copy Fail)
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC
对 CVE-2026-31431 的复现分析、C 改编的 exp。
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC
CVE-2026-31431 - Copy Fail - PoC exploit
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC★ 1
george1-adel/CVE-2026-41940_exploit
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
cPanel malware, CVE-2026-41940, virus removal
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC★ 3
Easy-to-understand version of CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗GitHub PoC★ 1
kmaruthisrikar/CVE-2026-41940-cPanel-Auth-Bypass-Exploit
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
https://devtint.github.io/CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗Exploit-DB
JUNG Smart Visu Server 1.1.1050 - Dos
JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication
41RISK
open ↗GitHub PoC★ 4
shahidmallaofficial/cpanel-cve-2026-41940-fix
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC★ 1
0xabdoulaye/CPANEL-CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open ↗GitHub PoC
Black-box penetration test against HackSudo Thor : CVE-2014-6271 Shellshock RCE through Apache mod_cgi, chained with sudo misconfiguration and bash eval injection for full privilege escalation. Includes custom CSRF-aware brute force tooling and Metasploit RPC automation.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
100RISK
open ↗GitHub PoC★ 31
BPF-LSM mitigation for CVE-2026-31431 (Copy Fail) — denies AF_ALG socket creation cluster-wide
crypto: algif_aead - Revert to operating out-of-place
100RISK
open ↗Exploit-DB
NiceGUI 3.6.1 - Path Traversal
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
41RISK
open ↗GitHub PoC
HackTheBox — CCTV (Easy/Linux) | CVE-2024-51482 + SqlMap+ SSH Key + Root
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
75RISK
open ↗Exploit-DB
deephas 1.0.7 - Prototype Pollution
deepHas vulnerable to Prototype Pollution via constructor.prototype
48RISK
open ↗Exploit-DB
Repetier-Server 1.4.10 - Path Traversal
Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE
48RISK
open ↗Exploit-DB
Windows 11 25H2 - Heap Overflow
Windows Hyper-V Remote Code Execution Vulnerability
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.