Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

80,051cataloged exploits

36,945CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,476Referência 23,442GitHub PoC 15,268VulnCheck XDB 8,970Nuclei 4,393Metasploit 3,502✓ verified onlyrecent popular risk

80,043 exploits

GitHub PoC

This project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackMe lab, which demonstrates a Linux kernel page-cache corruption vulnerability capable of achieving local priviledge escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 Jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RISK

GitHub PoC

CVE-2026-49085 WP Insightly PHP Object Injection Exploit

CVE-2026-49085CRITICAL17 Jun 2026

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

48RISK

GitHub PoC

Log4Shell (CVE-2021-44228) 보안 실습 환경 - Log4j 2.14.1 취약 로그 수집 서버

CVE-2021-44228CRITICALunder attackransomware17 Jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

GitHub PoC

CVE-2026-9691: Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule

CVE-2026-9691CRITICAL17 Jun 2026

WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability

48RISK

VulnCheck XDB

initial-access

CVE-2021-34427—17 Jun 2026

In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessibl

50RISK

VulnCheck XDB

local

CVE-2021-3156HIGHunder attack17 Jun 2026

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege

100RISK

GitHub PoC

CVE-2026-39808 - Fortinet Sandbox - Draft

CVE-2026-39808CRITICALunder attack17 Jun 2026

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

100RISK

VulnCheck XDB

initial-access

CVE-2021-44228CRITICALunder attackransomware17 Jun 2026

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

100RISK

VulnCheck XDB

initial-access

CVE-2026-24061CRITICALunder attack17 Jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

CVE-2026-42758 WebinarIgnition Exploit

CVE-2026-42758CRITICAL17 Jun 2026

WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability

48RISK

VulnCheck XDB

initial-access

CVE-2026-8206CRITICAL17 Jun 2026

Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

48RISK

GitHub PoC

CVE-2026-5411 WP Captcha PRO

CVE-2026-5411HIGH17 Jun 2026

WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

41RISK

GitHub PoC

CVE-2026-49104 Integration for Keap/Infusionsoft PHP Object Injection Exploit

CVE-2026-49104CRITICAL17 Jun 2026

WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability

48RISK

GitHub PoC

CVE-2026-39813 - Fortinet Sandbox - Draft

CVE-2026-39813CRITICAL17 Jun 2026

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.

53RISK

GitHub PoC

rootdirective-sec/CVE-2026-49060-Lab

CVE-2026-49060CRITICAL17 Jun 2026

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability

48RISK

GitHub PoC

CVE-2026-7654 Admin Columns PHP Object Injection RCE Exploit

CVE-2026-7654HIGH17 Jun 2026

Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value

41RISK

GitHub PoC

CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit

CVE-2026-49083HIGH17 Jun 2026

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

41RISK

GitHub PoC

The project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached file pages without altering files on disk.

CVE-2026-46300HIGH17 Jun 2026

net: skbuff: preserve shared-frag marker during coalescing

56RISK

VulnCheck XDB

initial-access

CVE-2026-48907CRITICALunder attack17 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

GitHub PoC

CVE-2026-5415 WP Captcha PRO Authenticated Authentication Bypass Exploit

CVE-2026-5415HIGH17 Jun 2026

WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link

41RISK

GitHub PoC

akpmarcelin/CVE-2026-24061-lab

CVE-2026-24061CRITICALunder attack17 Jun 2026

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment

100RISK

GitHub PoC

segunakinsoyinu/CVE-2024-42009-roundcube-xss

CVE-2024-42009CRITICALunder attack17 Jun 2026

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea

100RISK

VulnCheck XDB

initial-access

CVE-2026-42945CRITICAL17 Jun 2026

NGINX ngx_http_rewrite_module vulnerability

60RISK

GitHub PoC

Write-ups from completed TryHackMe rooms — Linux privilege escalation, sudo buffer overflow (CVE-2019-18634), and OWASP Top 10 (2025).

CVE-2019-18634—17 Jun 2026

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

28RISK

GitHub PoC

CVE‑2024‑20399 - Draft

CVE-2024-20399MEDIUMunder attack17 Jun 2026

Cisco NX-OS Software CLI Command Injection Vulnerability

63RISK

GitHub PoC★ 1

PoC de CVE-2026-20262: escritura arbitraria de archivos por path traversal en Cisco Catalyst SD-WAN Manager (autenticado).

CVE-2026-20262MEDIUMunder attack17 Jun 2026

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

68RISK

GitHub PoC

d4ngkh04w/CVE-2020-7961

CVE-2020-7961CRITICALunder attack17 Jun 2026

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

100RISK

GitHub PoC

CVE-2026-49079 JetSearch SQL Injection Exploit

CVE-2026-49079CRITICAL17 Jun 2026

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

48RISK

GitHub PoC

CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems

CVE-2026-48907CRITICALunder attack17 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

GitHub PoC

CVE-2026-48907

CVE-2026-48907CRITICALunder attack17 Jun 2026

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

100RISK

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.