Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
87,899cataloged exploits
40,763CVEs with public exploitation
24,696lab-tested
AllReferência 26,463Exploit-DB 24,489GitHub PoC 18,324VulnCheck XDB 10,507Nuclei 4,577Metasploit 3,539✓ verified onlyrecentpopularrisk
87,899 exploits
GitHub PoC★ 1
vulnerability check for CVE-2026-109618 / CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
100RISK
open ↗GitHub PoC
Divineokoduwa/CVE-2020-1472-Zerologon-Vulnerability-Assessment
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗GitHub PoC
BIBILZERODAY/CVE-2026-104736-Mass-Webshell-CVE
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
63RISK
open ↗GitHub PoC
Notbetrieb für PHP, das sich nicht patchen lässt. Kein Fix für CVE-2026-109618 und CVE-2026-109619.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
php:7.4-fpm drop-in rebuilt with the CVE-2026-109618/109619 fix (PHP2Shell)
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Pterodactyl PHP security updater for Ubuntu 24.04 and Debian 12/13. AppliePHP security updates for CVE-2026-109618 and CVE-2026-109619 (critical RCE vulnerabilities).
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell CVE-2026-109618·109619 보고서 나무위키 형식 파인만 풀이 페이지
RCE via OOM corruption
100RISK
open ↗VulnCheck XDB
initial-access
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
100RISK
open ↗GitHub PoC
Detection and inventory tool for PHP core CVE-2026-109618 and CVE-2026-109619: finds PHP installs, checks versions and mitigating settings, never triggers the bugs. Python 3 standard library only.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
Non-destructive detection toolkit + version-differential oracle for PHP2Shell (CVE-2026-109618/109619). Leak oracle verified 4/4 on PHP 8.5.11 vs 0/4 on 8.5.12. Docker lab included.
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Reproducer for CVE-2026-85316 — Apache Camel camel-platform-http unintended proxy mode from a path prefix (CWE-1220). Camel Spring Boot + Camel Quarkus.
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
33RISK
open ↗GitHub PoC★ 2
Local Docker trigger reproductions for PHP CVE-2026-109618 and CVE-2026-109619 advisories
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Cybersecurity research and vulnerability analysis
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
33RISK
open ↗GitHub PoC
Non-intrusive PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 1
synapes620/CVE-2026-110899
WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
41RISK
open ↗GitHub PoC★ 2
Passive PHP2Shell (CVE-2026-109618, CVE-2026-109619) exposure checker with branded HTML reports. Single-file Python, no dependencies, no exploit payloads.
RCE via OOM corruption
100RISK
open ↗GitHub PoC★ 6
Non-operational analysis and defensive guidance for CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
PHP2Shell Evaluación de CVE-2026-109618 and CVE-2026-109619
RCE via OOM corruption
100RISK
open ↗GitHub PoC
Passive PHP version checker for CVE-2026-109618 / CVE-2026-109619 (php2shell)
RCE via OOM corruption
100RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.