Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,039cataloged exploits
39,796CVEs with public exploitation
24,695lab-tested
AllReferência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecentpopularrisk
16,910 exploits
GitHub PoC★ 36
DirtyFrag Android Root is an Android app and helper module chain based on DirtyFrag (CVE-2026-43284). Tested on iQOO Z9 5G.
xfrm: esp: avoid in-place decrypt on shared skb frags
78RISK
open ↗GitHub PoC
Divi Membership (DiviEngine) pre-auth admin takeover — CVE-2026-19660 paypal_param bypass. Python PoC with exploit + cookie export.
Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter
48RISK
open ↗GitHub PoC
Defensive analysis, patch breakdown, and detection scanner for CVE-2026-14378 (WordPress DevKit Pro Plugin <= 2.3.0).
DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow
28RISK
open ↗GitHub PoC
ShadowForge-Cyber/CVE-2026-104286-POC
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.
78RISK
open ↗GitHub PoC★ 14
VC-Strike — VMware vCenter CVE-2026-59310 (unauth root RCE) & CVE-2026-59309 (SRP auth bypass) authorized pentest suite. GUI+CLI, multi-session C2, stdlib-only. 授权测试专用
vCenter directory-traversal vulnerability
78RISK
open ↗GitHub PoC★ 1
CVE-2026-90907 (CVSS 6.9) — Joomla! CMS unauthorized user account creation via com_users profile.save (authorization bypass). Non-destructive checker + authorized-use exploit PoC. Fixed in 5.4.9 / 6.1.4.
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
13RISK
open ↗GitHub PoC
CVE-2026-102425 - GUI CONSOLE
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RISK
open ↗GitHub PoC
CVE-2026-92966 — WordPress LatePoint ≤5.7.0 unauthenticated stored shortcode execution (CVSS 9.1, CWE-94). PoCbit mass-exploit PoC: plant [caption]/custom shortcode in booking first name → Customer Cabinet block double do_shortcode; fixed in 5.7.1. No API key. check/exploit/mass, hits.txt & exploited.txt, https://pocbit.org/pocs/cve-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
28RISK
open ↗GitHub PoC★ 10
Runtime exploit monitor for Apple document/image pipelines (iOS/macOS) — EXPMON concept: Frida agent + behavioral rules. First target: the CVE-2026-86950 glyph chain.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISK
open ↗GitHub PoC
Hassham1/CVE-2026-62059-ultimate-member-sqli-poc
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
21RISK
open ↗GitHub PoC
PitScaler: independent, source-linked briefing on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 (CTX697096). https://pitscaler.com
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC★ 1
34zY/CVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 2
71RISK
open ↗GitHub PoC★ 1
REDCap DataImport RCE
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
48RISK
open ↗GitHub PoC
Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
13RISK
open ↗GitHub PoC
Session-scoped TOTP rate limiting permits repeated verification attempts
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
21RISK
open ↗GitHub PoC
Safely detect Check Point CPM RCE CVE-2026-93616
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
100RISK
open ↗GitHub PoC
a practical NetScaler CTX697096 security-assessment workflow covering exposure validation, upgrade readiness and compromise-indicator hunting for CVE-2026-88771 through CVE-2026-88778.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC
Sanitized report and local PoC for CVE-2026-103584
attacker-controlled javascript license URL via XSS
8RISK
open ↗GitHub PoC
CVE-2026-96349 — WordPress SiteSkite plugin ≤2.1.8 unauthenticated RCE (CVSS 10.0, CWE-94). PoCbit mass-exploit PoC: legacy API-key autologin (?token=) + REST MCP siteskite_execute_php eval chain; fixed in 2.2.0. Check/exploit/mass bulk, hits.txt & exploited.txt, --lab self-test. Catalog: https://pocbit.org/pocs/cve-2026-96349
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
28RISK
open ↗GitHub PoC
NetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
93RISK
open ↗GitHub PoC
critical-severity unauthenticated Remote Code Execution (RCE) vulnerability impacting Orkes Conductor
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
68RISK
open ↗GitHub PoC
canhieu/cve-2026-100671-poc
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
41RISK
open ↗GitHub PoC
CVE-2026-62146 CRI-O ShmPath poisoning PoC and exploit
Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
21RISK
open ↗GitHub PoC★ 1
I like CVEs!
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-88789 (Apache Camel Quarkus camel-quarkus-support-xalan drops the JAXP external access restrictions, XXE / SSRF) — Camel Quarkus
Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
21RISK
open ↗GitHub PoC
Sanitized report and local PoC for CVE-2026-103585
attacker-controlled javascript license URL via XSS
8RISK
open ↗GitHub PoC
wuyou6956-glitch/cve-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗GitHub PoC
CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
48RISK
open ↗GitHub PoC★ 1
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.