Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,039cataloged exploits
39,796CVEs with public exploitation
24,695lab-tested
AllReferência 25,790Exploit-DB 24,487GitHub PoC 16,910VulnCheck XDB 9,820Nuclei 4,504Metasploit 3,528✓ verified onlyrecentpopularrisk
16,910 exploits
GitHub PoC★ 2
WordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
CVE-2026-90898 - Draft or TODO
Bifrost unauthenticated remote code execution via MCP stdio client registration
63RISK
open ↗GitHub PoC
zer0dayf/CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Docker CTF challenge for CVE-2025-57819
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
100RISK
open ↗GitHub PoC★ 13
Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Blue Team home lab: full incident response lifecycle (attack → detect → respond) with Wazuh SIEM + Suricata IDS, CVE-2007-2447 exploitation, MITRE ATT&CK mapping, and an AI-assisted alert triage pipeline.
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands
50RISK
open ↗GitHub PoC
shlln/CVE-2026-90847
EFM ipTIME C200E System Setup iux_set.cgi os command injection
48RISK
open ↗GitHub PoC★ 3
CVE-2026-87902 detector. WordPress get_page_template LFI class. Detect-only. Authorized lab.
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Simple Checks to look for indicators of compromise
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
100RISK
open ↗GitHub PoC
CVE-2026-61628 - nginx-ignition - High 8.1 - Unauthenticated Privilege Escalation (Administrator Account Creation)
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
41RISK
open ↗GitHub PoC
pwnVader/CVE-2026-87902-PoC-pwnVader
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC★ 1
WordPress Give Tributes CVE-2026-19658: Python 3 checker, FOFA helper, legacy Give form exploit path (CWE-502, CVSS 9.8).
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
48RISK
open ↗GitHub PoC
CVE-2026-68376 - Ubuntu Kernel 7.0.0-30
sctp: fix auth_hmacs array size in struct sctp_cookie
41RISK
open ↗GitHub PoC
CVE-2026-93485
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
41RISK
open ↗GitHub PoC
From-scratch exploit development in Python. No Metasploit. No frameworks. Raw socket-level implementation of real CVEs against authorized lab targets.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC★ 9
Unauthenticated RCE on Wordpress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC★ 1
HPLIP < 3.26.6 — Full admin takeover via PAPPL web interface (no auth). Related to CVE-2026-91097 through CVE-2026-91106 (CVSS 9.3)
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
41RISK
open ↗GitHub PoC★ 43
PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versi
48RISK
open ↗GitHub PoC
Laboratório de pentest em rede isolada: enumeração com nmap/nikto e exploração manual do Metasploitable2 (backdoor vsFTPd CVE-2011-2523, bindshell) com relatório técnico completo.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC★ 35
CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC★ 4
POC-CVE-2026-93674 Authenticated Blind command injection proof of concept exploit code
Langflow OSS is affected by multiple vulnerabilities
63RISK
open ↗GitHub PoC
CVE-2026-93485 - Draft or TODO
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
41RISK
open ↗GitHub PoC★ 1
Neutralizing CISA active Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) via modern eBPF, module disarmament, and containerd user namespaces.
netfilter: bridge: make ebt_snat ARP rewrite writable
71RISK
open ↗GitHub PoC
CVE-2026-13355 PoC — Meta Box AIO ≤3.11.0 unauthenticated admin privesc via MB Frontend Submission + User Profile shortcode chain. Python check/exploit, FOFA helper, mass scan with live flow.
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
48RISK
open ↗GitHub PoC
griisemine/cve-2026-87902-detection
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph
98RISK
open ↗GitHub PoC
This project describes detailed information about the CVE-2026-51772 vulnerability.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multi
33RISK
open ↗GitHub PoC
pwnVader/CVE-2026-88877-PoC-pwnVader
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
48RISK
open ↗GitHub PoC★ 55
cve-2026-86060 PoC
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
78RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.