Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,793cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,218VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,788 exploits
GitHub PoC
Security audit notes for CVE-2025-29927 (Next.js middleware authorization bypass) - upgrade plan for architecture review
Authorization Bypass in Next.js Middleware
85RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618/109619) remediation guide on AWS + AWS WAF CloudFormation template (China regions validated)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Signed, tested backports of EOL PHP (7.4/8.0/8.1) for CVE-2026-109618 & CVE-2026-109619 (php2shell)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
🛡️ ACYBER Security Toolkit — Automated detection & patching of CVE-2026-109618 (php2shell RCE) across Ubuntu, Debian, RHEL, CentOS, Rocky & AlmaLinux.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
One command to find and fix PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on any Linux server or Mac. Patches every PHP install in place, keeping your current PHP version (distro, Sury or Remi builds), with an opt-in --force upgrade and rollback.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
A lightweight Python CLI to assess PHP2Shell (CVE-2026-109618 & CVE-2026-109619) exposure via version checks.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Log-only Cloudflare WAF rule to detect php2shell (CVE-2026-109618 / CVE-2026-109619) targeting
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Educational Docker labs for PHP CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
Research notes, a calibrated exploit and a detection template for the PHP session upload-progress RCEs (CVE-2026-109618 / CVE-2026-109619).
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detecteur CVE-2026-109618 / CVE-2026-109619 (php2shell) pour image Docker ou binaire PHP
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Quick vulnerability checker for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) — detection only, no exploit
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Unofficial security patch for PHP 7.3 (EOL) fixing PHP2Shell RCE — CVE-2026-109618 & CVE-2026-109619. Backported from the official PHP 7.4 fix. PHP 7.3 漏洞修复补丁
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Honeypot to attract attacks for php2shell (CVE-2026-109618 and CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu
38RISK
open ↗GitHub PoC★ 1
Read-only PHP2Shell package checker for Debian 12/13 (CVE-2026-109618, CVE-2026-109619).
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) Two critical, unauthenticated Remote Code Execution (RCE) bugs in PHP core. Triggered while PHP parses a request, before any application code runs.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 3
Unofficial patched PHP 7.4.33 for Synology DSM 6.2 x86_64 (replaces PHP7.4 7.4.30-0009). Fixes PHP2Shell (CVE-2026-109618/109619) plus 90 security backports. Drop-in install with backup and rollback, test page, build scripts. Tested on DS1815+.
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.