Public exploitation
Exploit catalog
Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.
79,305cataloged exploits
36,465CVEs with public exploitation
24,695lab-tested
AllExploit-DB 24,466Referência 23,051GitHub PoC 15,051VulnCheck XDB 8,883Nuclei 4,361Metasploit 3,493✓ verified onlyrecentpopularrisk
79,305 exploits
GitHub PoC
Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypass
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
41RISK
open ↗GitHub PoC★ 1
PoC for CVE-2026-75616, an authenticated OS command injection in TP-Link Archer C20 v6 firmware
Command Injection in Router Web Management Interface
41RISK
open ↗VulnCheck XDB
initial-access
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS
100RISK
open ↗VulnCheck XDB
initial-access
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS
78RISK
open ↗VulnCheck XDB
initial-access
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISK
open ↗GitHub PoC★ 3
내 공유기가 Zbtlink ENDLESSDOORS 백도어(CVE-2026-66747) 대상인지 클릭 한 번으로 검사하는 Windows 프로그램
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
48RISK
open ↗GitHub PoC★ 1
Exploit Title: Unauthenticated SQL Injection on CMS Made Simple <= 2.2.9
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open ↗VulnCheck XDB
local
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
93RISK
open ↗VulnCheck XDB
initial-access
Improper Control of Generation of Code ('Code Injection') in GitLab
63RISK
open ↗GitHub PoC
llaytynher/CVE-2026-0740-upload-template
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISK
open ↗GitHub PoC★ 4
Apple MacOS Screen Sharing Arbitrary File read/write -> RCE
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS
78RISK
open ↗VulnCheck XDB
info-leak
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a
90RISK
open ↗GitHub PoC
Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backdoor analysis (CVE-2011-2523), with firewall mitigation validated end-to-end.
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open ↗GitHub PoC
CVE-2026-32475
WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
63RISK
open ↗VulnCheck XDB
initial-access
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
75RISK
open ↗VulnCheck XDB
remote-with-credentials
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as
83RISK
open ↗VulnCheck XDB
remote-with-credentials
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as
83RISK
open ↗GitHub PoC
CPTS HackTheBox - Penetration Test Report: WordPress Path Traversal CVE-2019-11447
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce
35RISK
open ↗GitHub PoC
Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backdoor analysis (CVE-2011-2523), with firewall mitigation validated end-to-end.
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote at
60RISK
open ↗GitHub PoC
Hands-on reproduction of CVE-2024-28000 in LiteSpeed Cache using an isolated WordPress lab. Includes reconnaissance, vulnerable hash recovery, Administrator privilege escalation proof, cleanup, and remediation-focused documentation.
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
75RISK
open ↗GitHub PoC
Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is po
100RISK
open ↗VulnCheck XDB
initial-access
Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
75RISK
open ↗GitHub PoC
CVE-2022-36804 Bitbucket command execution and file transfer tool
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗VulnCheck XDB
remote-with-credentials
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 bef
100RISK
open ↗GitHub PoC★ 2
wp2shell — WordPress Core Pre-Auth RCE Chain poc for CVE-2026-63030 and CVE-2026-60137
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
100RISK
open ↗GitHub PoC
JCEzploit is a powerful, fully-automated RCE exploit for Joomla JCE (CVE-2026-48907) featuring interactive shell, batch command execution, file download capability, and proxy support. Built with Python & Rich for penetration testers. Ethical use only. By Sudeepa Wanigarathna.
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
100RISK
open ↗GitHub PoC★ 5
Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 / 15.7.9 / 14.8.9.
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS
78RISK
open ↗GitHub PoC
CVE-2026-41567 1day
Docker: `PUT /containers/{id}/archive` executes container binary on the host
41RISK
open ↗GitHub PoC★ 1
CVE-2026-69836 — Unauthenticated RCE via Entra ID deserialization
Microsoft Entra ID Remote Code Execution Vulnerability
48RISK
open ↗GitHub PoC★ 5
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp
98RISK
open ↗We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.