Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,794cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,219VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,794 exploits
GitHub PoC
XAMPP for Windows の PHP を PHP2Shell（CVE-2026-109618 / CVE-2026-109619）修正版の PHP 8.2.35 に入れ替える非公式スクリプト
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell (CVE-2026-109618/109619) one-click detect & fix tool
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 7
Node.js Brotli Decoder OOB Write to RCE
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗VulnCheck XDB
info-leak
Zlib compressed protocol header length confusion may allow memory read
100RISK
open ↗GitHub PoC★ 1
FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients.
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
33RISK
open ↗GitHub PoC
Independent PHP2Shell lab: CVE-2026-109618/109619 differential validation, FastCGI harness and reproducible results
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
PoC demonstrations for PHP vulnerabilities CVE-2026-109618 & CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Security update for CVE-2026-91403
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE
48RISK
open ↗GitHub PoC
PHP 8.5.12 binaries built for a Raspberry Pi 1B (armv6l+VFPv2). Stopgap solution for CVE-2026-109618 and CVE-2026-109619.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Demo of doc-review process using Log4Shell (CVE-2021-44228) advisory facts
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Source + build recipe for the php2shell (CVE-2026-109618/109619) backport to CentOS 7 / IUS PHP 7.2
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
quick and simple powershell based Internal PHP Version Assessment Checks for PHP versions potentially vulnerable to: CVE-2026-109618 / CVE-2026-109619 (PHP2Shell)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Advanced Pre-Auth RCE Exploit for PHP session.upload_progress (CVE-2026-109618 & 109619) by Farhad Hosen.
RCE via stale global state
100RISK
open ↗GitHub PoC
Bluefire Redteam checker for Ivanti Connect Secure CVE-2026-104935. Version and reachability only.
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb
100RISK
open ↗GitHub PoC
Unofficial backport of php commit (Avoid state corruption via bailout, branch PHP-7.4-CVE-2026-109618-109619) to the final PHP 7.2 release, 7.2.34. Not reviewed by the PHP team. Use as a bridge until you are on a supported PHP.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Research brief on Log4Shell (CVE-2021-44228) for an internal security awareness session. Every claim is backed by linked primary sources.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC
Reproducible audit trail for the Log4Shell (CVE-2021-44228) and follow-up (CVE-2021-45046) study-group walkthrough
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open ↗GitHub PoC★ 6
CVE-2026-111497 — Node.js Brotli Decoder OOB Write: Deep Analysis & Structural Unreachability Proof. MLEN_MAX = BLOCK_SIZE_CAP = 2^24 makes RCE structurally unreachable.
Out-of-Bounds Write in Google Brotli Decoder
70RISK
open ↗GitHub PoC
Security advisory and PoC for CVE-2026-107079 affecting Systrome Validation & Certification 1.0.
An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parame
33RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.