Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

80,095cataloged exploits

36,945CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,476Referência 23,442GitHub PoC 15,312VulnCheck XDB 8,970Nuclei 4,393Metasploit 3,502✓ verified onlyrecent popular risk

80,095 exploits

VulnCheck XDB

initial-access

CVE-2026-50751CRITICALunder attackransomware16 Jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISK

open ↗

GitHub PoC

right payload for java CVE

CVE-2025-24813CRITICALunder attack16 Jun 2026

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

100RISK

open ↗

GitHub PoC

CVE-2025-49844 exploit script

CVE-2025-49844CRITICAL16 Jun 2026

Redis Lua Use-After-Free may lead to remote code execution

85RISK

open ↗

VulnCheck XDB

info-leak

CVE-2024-23897CRITICALunder attackransomware16 Jun 2026

Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an

100RISK

open ↗

GitHub PoC

Penetration testing assessment of a vulnerable IIS 6.0 WebDAV server, demonstrating reconnaissance, enumeration, exploitation (CVE-2017-7269), and privilege escalation to SYSTEM, along with risk analysis and remediation strategies.

CVE-2017-7269CRITICALunder attack16 Jun 2026

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in

100RISK

open ↗

VulnCheck XDB

remote-with-credentials

CVE-2025-49844CRITICAL16 Jun 2026

Redis Lua Use-After-Free may lead to remote code execution

85RISK

open ↗

GitHub PoC★ 1

Mass Scanner For Drupal Exploit CVE-2026-9082

CVE-2026-9082CRITICALunder attack16 Jun 2026

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

100RISK

open ↗

GitHub PoC★ 62

CVE-2026-41940 exploitation proof-of-concept project

CVE-2026-41940CRITICALunder attackransomware16 Jun 2026

WebPros cPanel and WHM Authentication Bypass via Login Flow

100RISK

open ↗

VulnCheck XDB

info-leak

CVE-2025-49132CRITICAL16 Jun 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

VulnCheck XDB

remote-with-credentials

CVE-2026-40217HIGH16 Jun 2026

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/t

61RISK

open ↗

GitHub PoC★ 1

A script that gives you the credentials of a Pterodactyl panel vulnerable to CVE-2025-49132

CVE-2025-49132CRITICAL16 Jun 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

GitHub PoC

A script that gives you the credentials of a Pterodactyl panel vulnerable to CVE-2025-49132

CVE-2025-49132CRITICAL16 Jun 2026

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

75RISK

open ↗

GitHub PoC

CVE-2025-30208 exploit script

CVE-2025-30208MEDIUM16 Jun 2026

Vite bypasses server.fs.deny when using `?raw??`

70RISK

open ↗

GitHub PoC

KovachVL/CVE-2026-55168

CVE-2026-55168MEDIUM16 Jun 2026

Runtipi: Authenticated arbitrary file write via backup restore symlink planting

33RISK

open ↗

GitHub PoC★ 8

This is a Linux Kernel Local Privilege Escalation PoC code for CVE-2026-52943 a use-after-free in skbuff.c, my first 0day found by me in linux kernel

CVE-2026-52943HIGH16 Jun 2026

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

41RISK

open ↗

GitHub PoC

Resellnom/litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420HIGHunder attack16 Jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISK

open ↗

GitHub PoC

0xdak/CVE-2026-44881_exploit

CVE-2026-44881HIGH16 Jun 2026

Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

41RISK

open ↗

VulnCheck XDB

info-leak

CVE-2025-30208MEDIUM16 Jun 2026

Vite bypasses server.fs.deny when using `?raw??`

70RISK

open ↗

GitHub PoC

CVE-2026-47101, CVE-2026-47102, CVE-2026-40217

CVE-2026-47101HIGH16 Jun 2026

LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

41RISK

open ↗

GitHub PoC

Saku0512/CVE-2026-54686-poc

CVE-2026-54686MEDIUM16 Jun 2026

Warp: DCS lifecycle hook spoofing can alter terminal session metadata

33RISK

open ↗

GitHub PoC★ 2

mahfuzreham/litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420HIGHunder attack16 Jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISK

open ↗

GitHub PoC★ 7

Manage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.

CVE-2026-45585MEDIUM16 Jun 2026

Windows BitLocker Security Feature Bypass Vulnerability

33RISK

open ↗

GitHub PoC★ 1

CVE-2026-54420

CVE-2026-54420HIGHunder attack16 Jun 2026

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

71RISK

open ↗

VulnCheck XDB

initial-access

CVE-2026-4480CRITICAL16 Jun 2026

Samba: samba: remote code execution in printing subsystem via unescaped job description

68RISK

open ↗

GitHub PoC

CVE-2026-50751 Mass Scanner

CVE-2026-50751CRITICALunder attackransomware16 Jun 2026

User Authentication Bypass in VPN Remote Access and Mobile Access

100RISK

open ↗

GitHub PoC

Kioptrix Level 1 writeup - CVE-2003-0201 Samba trans2open

CVE-2003-0201—16 Jun 2026

Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x vers

60RISK

open ↗

GitHub PoC

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request.

CVE-2026-37071CRITICAL15 Jun 2026

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4

48RISK

open ↗

GitHub PoC

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.

CVE-2026-37070MEDIUM15 Jun 2026

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated

33RISK

open ↗

GitHub PoC

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request.

CVE-2026-37067MEDIUM15 Jun 2026

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauth

33RISK

open ↗

GitHub PoC

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php

CVE-2026-37072CRITICAL15 Jun 2026

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-update

48RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.