Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,039cataloged exploits
39,796CVEs with public exploitation
24,695lab-tested
AllReferência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecentpopularrisk
16,910 exploits
GitHub PoC★ 2
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
100RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103441
Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
41RISK
open ↗GitHub PoC★ 1
CVE-2026-12227 is a critical (CVSS 9.8) unauthenticated Local File Inclusion (LFI) vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including 45.16.0, This can lead to sensitive data exposure, access control bypass, or even full Remote Code Execution (RCE).
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
63RISK
open ↗GitHub PoC★ 1
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103440
pagetriagelist discloses suppressed reviewer usernames
28RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS
28RISK
open ↗GitHub PoC
CVE-2026-102425 PoC (PoCbit) — Joomla Balbooa Forms (com_baforms) <2.4.3.4 unauth RCE via field shortcode injection in post-submission PHP eval(). check + exploit + mass bulk. https://pocbit.org/pocs/cve-2026-102425
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
48RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
28RISK
open ↗GitHub PoC
Security PoC payload host for CVE-2026-91159 oEmbed test (authorized bug bounty)
Discourse: Stored oEmbed HTML injection via allowed iframe
41RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
41RISK
open ↗GitHub PoC
Authlib 1.7.2: Signature Verification Bypass - General JSON JWS Accepts Unsigned Payload when `signatures` is Empty
Authlib library contains a signature‑verification bypass vulnerability
48RISK
open ↗GitHub PoC★ 2
Next.js next/og unauthenticated RCE (CVE-2026-94545) - PoC
Satori-generated SVG has improper escaping
33RISK
open ↗GitHub PoC
CVE-2026-76570 PoC (PoCbit) — Joomla JCTables (com_jctables) <1.21.1: unauth SQL read/write via front-end JSON API getdatarow/getrow (CVSS 4.0 10.0 AT:N). check + exploit + mass. https://www.cve.org/CVERecord?id=CVE-2026-76570
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
48RISK
open ↗GitHub PoC
wuyou6956-glitch/cve-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
100RISK
open ↗GitHub PoC
JailBr3ak/CVE-2026-97347
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
41RISK
open ↗GitHub PoC
Sanitized report summary and local PoC for CVE-2026-103442
MergeAccount PHP object injection via session-key substitution
41RISK
open ↗GitHub PoC★ 2
EUVD-2026-89950 Improper Handling of URL Encoding (Hex Encoding) (CWE-177)
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
78RISK
open ↗GitHub PoC
single PoC for CVE-2026-18143 Unauth AFU (Arbitrary File Upload)
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
63RISK
open ↗GitHub PoC
kikozz/CVE-2013-3660-win32k.sys
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo
98RISK
open ↗GitHub PoC
Sanitized WikiLambda report and patch verification notes for CVE-2026-96872.
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
28RISK
open ↗GitHub PoC★ 9
Docker lab for validating CVE-2026-84383 in libheif through Discourse
libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
48RISK
open ↗GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96877.
Reflected XSS through Cargo Drilldown full-text search
33RISK
open ↗GitHub PoC
Sanitized Cargo report and patch verification notes for CVE-2026-96878.
Cargo Exhibit field alias allows stored XSS
33RISK
open ↗GitHub PoC
Sanitized Wikibase report and patch verification notes for CVE-2026-100380.
Reflected XSS in Wikibase Special:SetLabel language validation
33RISK
open ↗GitHub PoC★ 5
XWP_RCE — CVE-2026-87902 Hacker Console
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Sanitized UploadWizard report and patch verification notes for CVE-2026-100381.
UploadWizard Flickr collection and set titles allow DOM XSS
33RISK
open ↗GitHub PoC
CVE-2026-82901 — Ultra Addons for Contact Form 7 Mass Exploiter (GUI + CLI)
Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field
48RISK
open ↗GitHub PoC
Published Epson EH-TW5350 CVE · Hard-coded credentials · B-BEAM-BOB team
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection
48RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.