Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

79,057cataloged exploits

36,288CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,460Referência 22,910GitHub PoC 14,997VulnCheck XDB 8,843Nuclei 4,358Metasploit 3,489✓ verified onlyrecent popular risk

14,997 exploits

GitHub PoC★ 1

A web version of the bash scripts wrote for Check Point CVE-2026-50751 and CVE-2026-50752. This uses a local server to scan and make changes using Check Point Web API

CVE-2026-50751CRITICALunder attackransomware18 Jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISK

GitHub PoC

CVE-2025-6254 — Doctreat Core <= 1.6.8 — Unauthenticated Privilege Escalation

CVE-2025-6254CRITICAL18 Jun 2026

Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

48RISK

GitHub PoC★ 11

0xCyberstan/CVE-2026-46215-POC

CVE-2026-46215HIGH18 Jun 2026

drm: Set old handle to NULL before prime swap in change_handle

41RISK

GitHub PoC

Full-chain CVE-2025-57819 PoC for FreePBX 15, 16, and 17: unauthenticated SQLi to RCE and root takeover.

CVE-2025-57819CRITICALunder attack18 Jun 2026

FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

100RISK

GitHub PoC

Store vulnerability POC files including CVE-2026-42588 Spring RCE xml payload

CVE-2026-42588HIGH18 Jun 2026

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector

41RISK

GitHub PoC★ 10

CVE-2026-50656

CVE-2026-50656HIGH18 Jun 2026

Microsoft Defender Elevation of Privilege Vulnerability

46RISK

GitHub PoC

The project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 Jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RISK

GitHub PoC

CVE-2026-42758 WebinarIgnition Exploit

CVE-2026-42758CRITICAL17 Jun 2026

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

48RISK

GitHub PoC

CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit

CVE-2026-49083HIGH17 Jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISK

GitHub PoC

CVE-2026-7459 Simple History Missing Authorization Account Takeover Exploit

CVE-2026-7459HIGH17 Jun 2026

Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint

41RISK

GitHub PoC

Exploitation and mitigation analysis of CVE-2021-3156 heap-based buffer overflow in sudo

CVE-2021-3156HIGHunder attack17 Jun 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

GitHub PoC

CVE-2026-49104 Integration for Keap/Infusionsoft PHP Object Injection Exploit

CVE-2026-49104CRITICAL17 Jun 2026

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

48RISK

GitHub PoC

CVE-2026-49079 JetSearch SQL Injection Exploit

CVE-2026-49079CRITICAL17 Jun 2026

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

48RISK

GitHub PoC

This project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackMe lab, which demonstrates a Linux kernel page-cache corruption vulnerability capable of achieving local priviledge escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 Jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RISK

GitHub PoC

CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit

CVE-2026-7465HIGH17 Jun 2026

Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

41RISK

GitHub PoC

hulina9900-boop/DIY-CVE-2026-42945-POC

CVE-2026-42945CRITICAL17 Jun 2026

NGINX ngx_http_rewrite_module vulnerability

60RISK

GitHub PoC

87achrafg-stack/CVE-2026-49083

CVE-2026-49083HIGH17 Jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISK

GitHub PoC★ 1

PoC de CVE-2026-20262: escritura arbitraria de archivos por path traversal en Cisco Catalyst SD-WAN Manager (autenticado).

CVE-2026-20262MEDIUMunder attack17 Jun 2026

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

68RISK

GitHub PoC★ 143

PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare

CVE-2026-46331HIGH17 Jun 2026

net/sched: fix pedit partial COW leading to page cache corruption

41RISK

GitHub PoC

CVE-2026-49105 WP Zendesk PHP Object Injection Exploit

CVE-2026-49105CRITICAL17 Jun 2026

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISK

GitHub PoC

segunakinsoyinu/CVE-2024-42009-roundcube-xss

CVE-2024-42009CRITICALunder attack17 Jun 2026

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea

100RISK

GitHub PoC

Write-ups from completed TryHackMe rooms — Linux privilege escalation, sudo buffer overflow (CVE-2019-18634), and OWASP Top 10 (2025).

CVE-2019-18634—17 Jun 2026

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RISK

GitHub PoC

rootdirective-sec/CVE-2026-49060-Lab

CVE-2026-49060CRITICAL17 Jun 2026

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

48RISK

GitHub PoC

akpmarcelin/CVE-2026-24061-lab

CVE-2026-24061CRITICALunder attack17 Jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

CVE-2026-5411 WP Captcha PRO

CVE-2026-5411HIGH17 Jun 2026

WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

41RISK

GitHub PoC

CVE-2026-39813 - Fortinet Sandbox - Draft

CVE-2026-39813CRITICAL17 Jun 2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.

53RISK

GitHub PoC

CVE-2026-39808 - Fortinet Sandbox - Draft

CVE-2026-39808CRITICALunder attack17 Jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RISK

GitHub PoC

CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule

CVE-2026-9691CRITICAL17 Jun 2026

WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

48RISK

GitHub PoC

CVE-2026-8206 Kirki Plugin Unauthenticated Account Takeover Exploit

CVE-2026-8206CRITICAL17 Jun 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RISK

GitHub PoC

CVE-2026-45777 PoC

CVE-2026-45777CRITICAL17 Jun 2026

Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection

28RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.