Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,793cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,218VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,793 exploits
GitHub PoC
Sigma detection rules for php2shell OOM multipart probing (CVE-2026-109618 / CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
CVE-2026-109618 - multipart OOM bailout corruption trigger (PHP < 8.2.35/8.3.36/8.4.27/8.5.12)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
PoC demonstrations for PHP vulnerabilities CVE-2026-109618 & CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detection + remediation scanner for php2shell (CVE-2026-109618/109619) and react2shell (CVE-2025-55182).
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Bulk SSH scanner that inventories every PHP installation across Linux servers and flags builds affected by php2shell (CVE-2026-109618/109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
PHP vulnerability checker for PHP2Shell (CVE-2026-109618/109619): audits servers, Docker images & CI. Backport-aware, zero-dep.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Log-only Cloudflare WAF rule to detect php2shell (CVE-2026-109618 / CVE-2026-109619) targeting
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Honeypot to attract attacks for php2shell (CVE-2026-109618 and CVE-2026-109619)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 102
Scanner for PHP2Shell (CVE-2026-109618/109619): URL blackbox, local device and SSH.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 7
Scan local PHP, Docker images, running containers, URLs and inventories for PHP2Shell exposure (CVE-2026-109618 / CVE-2026-109619). Zero-dependency Node CLI with terminal UI, HTML dashboard and GitHub Action. Read-only, no exploit code.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Quick vulnerability checker for CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) — detection only, no exploit
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Diagnóstico, parcheo y mitigación de PHP2Shell (CVE-2026-109618 / CVE-2026-109619) en Ubuntu
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Unofficial security patch for PHP 7.3 (EOL) fixing PHP2Shell RCE — CVE-2026-109618 & CVE-2026-109619. Backported from the official PHP 7.4 fix. PHP 7.3 漏洞修复补丁
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Detecteur CVE-2026-109618 / CVE-2026-109619 (php2shell) pour image Docker ou binaire PHP
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 7
Node.js Brotli Decoder OOB Write to RCE
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗VulnCheck XDB
initial-access
An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a docu
38RISK
open ↗GitHub PoC
Free self-check for PHP2Shell (CVE-2026-109618, CVE-2026-109619): find every PHP on your server, see if it's exposed, and fix it. Works with AI assistants.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Passive PHP version checker for CVE-2026-109618 / CVE-2026-109619 (php2shell)
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.