Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,900cataloged exploits
36,847CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,475Referência 23,360GitHub PoC 15,228VulnCheck XDB 8,946Nuclei 4,390Metasploit 3,501✓ verified onlyrecentpopularrisk
79,900 exploits
VulnCheck XDB
initial-access
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
60RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RISK
open ↗VulnCheck XDB
initial-access
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RISK
open ↗GitHub PoC★ 2
a shitty poc utilizing CVE-2026-0059.
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overfl
41RISK
open ↗GitHub PoC★ 27
Technical analysis and Proof-of-Concept (PoC) for CVE-2026-41089, a critical unauthenticated Remote Code Execution (RCE) vulnerability in the Windows Netlogon service affecting Domain Controllers.
Windows Netlogon Remote Code Execution Vulnerability
70RISK
open ↗GitHub PoC
Mirrored from tegal1337/CVE-2022-0441
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
60RISK
open ↗GitHub PoC★ 1
gigachadusers/CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerability
33RISK
open ↗GitHub PoC
OnePlus Ace 3 preload.so for CVE-2026-43499 (GhostLock)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC★ 11
CVE-2026-52910 kernel crash PoC. screen goes off.
bpf: Free reuseport cBPF prog after RCU grace period.
41RISK
open ↗VulnCheck XDB
initial-access
Qwik affected by unauthenticated RCE via server$ Deserialization
63RISK
open ↗VulnCheck XDB
initial-access
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗VulnCheck XDB
remote-with-credentials
n8n Vulnerable to Remote Code Execution via Expression Injection
100RISK
open ↗VulnCheck XDB
initial-access
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
85RISK
open ↗GitHub PoC
Manage BitLocker recovery keys, monitor drive encryption status, and unlock volumes through a portable interface for Windows.
Windows BitLocker Security Feature Bypass Vulnerability
33RISK
open ↗GitHub PoC★ 6
jaf0rk/CVE-2026-9973-exploit
Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code i
41RISK
open ↗GitHub PoC★ 4
Use CVE-2026-43499 on Redmi Turbo 5 to escalate privilege
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow
NGINX Map directive and Regex matching vulnerability
48RISK
open ↗GitHub PoC★ 1
PoC reproducer for CVE-2026-53913 (Apache Camel camel-keycloak): KeycloakSecurityPolicy fails open in the Basic Setup — with no required roles/permissions the token is never verified, so any forged/garbage bearer token bypasses authentication (unauthenticated RCE). Fixed in 4.18.3/4.21.0.
Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted
48RISK
open ↗GitHub PoC
WhatsWrongAndWhy/CVE-2017-16995
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
50RISK
open ↗GitHub PoC
WhatsWrongAndWhy/CVE-2017-7308
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
43RISK
open ↗GitHub PoC★ 3
Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RISK
open ↗GitHub PoC
CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
100RISK
open ↗GitHub PoC★ 1
CVE-2026-52813 (Gogs Path Traversal → Git Hooks RCE) defensive writeup: root-cause & patch analysis, Sigma/SIEM detection rules, IOCs, non-intrusive version scanner. No weaponized PoC.
Gogs: Path Traversal in organization name results in RCE through Git hooks
48RISK
open ↗GitHub PoC
WhatsWrongAndWhy/CVE-2018-18955
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalat
38RISK
open ↗GitHub PoC
PoC reproducer for CVE-2026-49099 (Apache Camel camel-salesforce): the non-Camel-prefixed sObjectQuery header escapes the HTTP header filter and overrides the producer's configured SOQL (SOQL injection / broken access control). Fixed in 4.14.8/4.18.3/4.21.0.
Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour
33RISK
open ↗GitHub PoC★ 1
PoC for CVE-2026-57588 - SQL injection in Nessus 10.12.0 XML import. Generates malicious .nessus files to enumerate databases, exfiltrate credentials, and test time-based blind injection. For authorized security research. Author: Sudeepa Wanigarathna. Patched in 10.12.1.
SQL Injection in Nessus via Malicious Scan Result File Import
28RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.