Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,806cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,231VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,806 exploits
GitHub PoC★ 4
Patches and Windows build scripts for PHP 5.6-7.4 fixing CVE-2026-109618 / CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Non-destructive checker, porting analysis and self-built patches for CVE-2026-109618 / CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Quick and dirty hunting script for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on ISPConfig servers.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Free, read-only checker for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Finds every PHP build, detects vendor back-ports and unrestarted services, and prints next steps.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
Proof-of-concept for CVE-2026-109618 and CVE-2026-109619 (PHP upload-progress RCE)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
PHP 8.0.30 backport for CVE-2026-109618 / CVE-2026-109619 (Remi php80, EL7 RPMs)
RCE via OOM corruption
100RISK
open ↗GitHub PoC
A cybersecurity vulnerability analysis of CVE-2021-26855, including its severity, patch, Cyber Kill Chain, and incident response.
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗GitHub PoC★ 1
synapes620/CVE-2026-110899
WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
41RISK
open ↗GitHub PoC★ 8
PHP 7.4 for Windows with CVE-2026-109618 / CVE-2026-109619 Backport
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗GitHub PoC★ 132
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 41
Proof of concept for CVE-2026-109618/CVE-2026-109619: PHP2Shell
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Audit and interim mitigation scripts for PHP2Shell (CVE-2026-109618/109619) on Forge-managed Ubuntu servers
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Cybersecurity assignment on CVE-2026-97859, severity analysis, patching, and the Cyber Kill Chain.
Gitea API disclosure of private user social graph, keys and stars
33RISK
open ↗GitHub PoC
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell CVE-2026-109618·109619 보고서 나무위키 형식 파인만 풀이 페이지
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
local
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
68RISK
open ↗GitHub PoC
Emergency mitigation guide and snippets for PHP CVE-2026-109618 / CVE-2026-109619 (php2shell)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 6
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 4
Hunting pack for PHP2Shell (CVE-2026-109618/109619): find vulnerable PHP assets and hunt for exploitation with Microsoft Defender, Sentinel and Azure tooling
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
php:7.4-fpm rebuilt from source with the official PHP2Shell backport (CVE-2026-109618 / CVE-2026-109619): the three things that break a 7.4 build in 2026, fixed
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
php2shell defense tools. safechecks, suricata/snort rules, mod_sec for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 2
Pre-auth RCE lab for CVE-2026-109618/CVE-2026-109619 - PHP session.upload_progress heap chain
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Security patch backports for EOL PHP (7.3/7.4): CVE-2026-109618/109619 full backport, Tier1/Tier2 CVEs. Unofficial, community effort.
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.