Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
85,566cataloged exploits
39,907CVEs with public exploitation
24,696lab-tested
AllReferência 25,846Exploit-DB 24,488GitHub PoC 17,314VulnCheck XDB 9,877Nuclei 4,513Metasploit 3,528✓ verified onlyrecentpopularrisk
17,314 exploits
GitHub PoC
CVE-2026-43499 research port for Galaxy Z Fold4 SM-F936W F936WVLU1AVGA (in progress)
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
PoC for CVE-2026-9090 — Casdoor SAML signature bypass (CWE-347). Reproduction-only; coordinated via CERT/CC VU#780781.
CVE-2026-9090
48RISK
open ↗GitHub PoC
OpenMed < 1.5.2 unauthenticated RCE via PII privacy-filter model loading and trust_remote_code=True
OpenMed < 1.5.2 Remote Code Execution via PII Model Loading
48RISK
open ↗GitHub PoC
CVE-2026-64638 adalah kerentanan Pre-Auth Reflected Cross-Site Scripting (XSS) di WordPress yang ditemukan pada tahun 2026. Kerentanan ini memungkinkan penyerang untuk menyisipkan kode JavaScript berbahaya ke halaman login WordPress (/wp-login.php) tanpa perlu autentikasi terlebih dahulu.
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malici
56RISK
open ↗GitHub PoC
Username Enumeration via Authentication Timing Side-Channel in PaperCut NG
PaperCut NG/MF: User enumeration via timing attack
33RISK
open ↗GitHub PoC★ 1
An explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.
Gitea Docker image trusts spoofable reverse-proxy headers by default
63RISK
open ↗GitHub PoC
uproot <= 5.7.4 code injection via unsafe Python source generation from ROOT TStreamerInfo metadata.
uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata
41RISK
open ↗GitHub PoC★ 2
SambaCry Explanation and Exploitation Demo with POC
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
100RISK
open ↗GitHub PoC★ 401
CVE-2026-9830 Proof of Concept
BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug
41RISK
open ↗GitHub PoC
CVE-2026-17544: PHP bcmath OOB write → universal memory-only RCE & disable_functions/open_basedir bypass. Offset-free runtime resolver. Verified on PHP 8.4.x / 8.5.x.
Out-of-bounds write in bccomp() via crafted operand and scale
41RISK
open ↗GitHub PoC★ 9
CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection
Metabase SQL injection via password reset endpoint
100RISK
open ↗GitHub PoC
KovachVL/CVE-2026-54356
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
41RISK
open ↗GitHub PoC
CS50's Introduction to Cybersecurity final project on React2Shell (CVE-2025-55182)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open ↗GitHub PoC
Mohaimenul370/Perform-an-RDP-exploitation-using-the-BlueKeep-vulnerability-CVE-2019-0708-on-Windows
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unau
100RISK
open ↗GitHub PoC
jeffmarlonmandela/CVE-2021-4034-PwnKit
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗GitHub PoC
PoC funcional de CVE-2026-52715 (GeoLeak): SQLi no autenticada en GEO my WordPress <= 4.5.5 via swlatlng/nelatlng. Laboratorio Docker + exploit time-based/boolean-based + exfiltracion sin comas en payload.
WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability
63RISK
open ↗GitHub PoC★ 5
KSuRoot 2.2.0 — One-click KernelSU rooting based on CVE-2026-43499. Synced from Root-My-Galaxy v0.2.6 with custom payload (.so) import. Mod by hmascs
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
Kentox493/CVE-2026-46300_Fragnesia
net: skbuff: preserve shared-frag marker during coalescing
56RISK
open ↗GitHub PoC
CVE-2026-72550 — Friendica Unauthenticated Stacked-Query SQL Injection PoC (CVSS 9.8 Critical)
Friendica Friendica - SQL Injection
48RISK
open ↗GitHub PoC★ 1
This package is not a complete root. It flips SELinux to Permissive and holds reclaim long enough for follow-on work. Host `uid=0` is not achieved here.
rtmutex: Use waiter::task instead of current in remove_waiter()
41RISK
open ↗GitHub PoC
CVE-2026-54433 Roundcube plain-text email stored XSS PoC
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plai
41RISK
open ↗GitHub PoC★ 64
CVE-2026-8452 PreAuth RCE
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
71RISK
open ↗GitHub PoC
CVE-2021-41773 Exploit Lab
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
100RISK
open ↗GitHub PoC
Proof of Concept (PoC) for CVE-2026-64638, a reflected XSS in WordPress Core < 7.0.3.
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
33RISK
open ↗GitHub PoC★ 1
Python client for the Thinkware U3000 dashcam's local WiFi control protocol, reverse-engineered from the official Android app. PoC tooling behind CVE-2026-101053, CVE-2026-101054, and CVE-2026-101055.
Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control
33RISK
open ↗GitHub PoC★ 3
Original research and PoC for an unauthenticated firmware update vulnerability with missing cryptographic firmware authentication in Netis NC63
Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication
41RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.