Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

71,114cataloged exploits
31,649CVEs with public exploitation
0lab-tested
13,116 exploits
GitHub PoC
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
CVE-2026-4885CRITICAL23 May 2026
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
48RISK
open
GitHub PoC1
CVE-2026-48172
CVE-2026-48172CRITICALunder attack23 May 2026
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
83RISK
open
GitHub PoC
Xmyronn/CVE-2026-11518-XSS
CVE-2026-11518MEDIUM23 May 2026
SourceCodester Inventory System User Management users.php cross site scripting
33RISK
open
GitHub PoC
CVE-2025-46822
CVE-2025-46822HIGH23 May 2026
Unauthenticated Arbitrary File Read via Absolute Path
56RISK
open
GitHub PoC
webdev75950-ux/nginx-rce-cve-2026-42945
CVE-2026-42945CRITICAL23 May 2026
NGINX ngx_http_rewrite_module vulnerability
60RISK
open
GitHub PoC
CVE-2026-0926 exploit. The Prodigy Commerce plugin for WordPress Local File Inclusion
CVE-2026-0926CRITICAL23 May 2026
Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters[template_name]
63RISK
open
GitHub PoC
CVE-2026-6279: Avada (Fusion) Builder <= 3.15.2 – Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler (fusion-builder)
CVE-2026-6279CRITICAL23 May 2026
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
48RISK
open
GitHub PoC3
CVE-2026-6279 — Avada Builder <= 3.15.2 Unauthenticated RCE via call_user_func()
CVE-2026-6279CRITICAL23 May 2026
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
48RISK
open
GitHub PoC
Langflow remote code execution exploit
CVE-2026-0770CRITICAL23 May 2026
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
68RISK
open
GitHub PoC
Ethical Hacking Assessment | Practical vulnerability testing of vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable2 using Kali Linux & Metasploit
CVE-2011-252323 May 2026
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
60RISK
open
GitHub PoC8
R3n3r0/CVE-2026-20700
CVE-2026-20700HIGHunder attack23 May 2026
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3,
71RISK
open
GitHub PoC
felisha-elmer/Sandbox-Challenge-Log4Shell-CVE-2021-44228-
CVE-2021-44228CRITICALunder attackransomware23 May 2026
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
100RISK
open
GitHub PoC1
CVE-2018-13379 mass exploiter for Fortinet FortiOS SSL VPN. Extracts credentials instantly, saves to CSV + PostgreSQL. Multi-threaded, no bullshit warnings.
CVE-2018-13379CRITICALunder attackransomware23 May 2026
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.
100RISK
open
GitHub PoC1
renewablehacking/CVE-2025-55182-React-19.2.0
CVE-2025-55182CRITICALunder attackransomware23 May 2026
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1
100RISK
open
GitHub PoC
Google Dorks for detecting CMS Made Simple < 2.2.10 SQL Injection (CVE-2019-9053). Built for security auditing and patch verification.
CVE-2019-905323 May 2026
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve
35RISK
open
GitHub PoC
Private exploit
CVE-2026-41940CRITICALunder attackransomware23 May 2026
WebPros cPanel and WHM Authentication Bypass via Login Flow
100RISK
open
GitHub PoC
CVE-2026-41901
CVE-2026-41901CRITICAL23 May 2026
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
48RISK
open
GitHub PoC
CVE-2026-6960: BookingPress Pro <= 5.6 – Unauthenticated Arbitrary File Upload
CVE-2026-6960CRITICAL23 May 2026
BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field
48RISK
open
GitHub PoC
mein-0/cve-2025-7771
CVE-2025-7771HIGH23 May 2026
Code Execution / Escalation of Privileges in ThrottleStop
41RISK
open
GitHub PoC1
Unauthenticated Privilege Escalation CVE-2026-9018: Easy Elements for Elementor
CVE-2026-9018HIGH23 May 2026
Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter
41RISK
open
GitHub PoC
CVE-2024-6387 POC (Currently being edited)
CVE-2024-6387HIGH22 May 2026
Openssh: regresshion - race condition in ssh allows rce/dos
63RISK
open
GitHub PoC2
CVE-2026-43494
CVE-2026-43494HIGH22 May 2026
net/rds: reset op_nents when zerocopy page pin fails
41RISK
open
GitHub PoC
Portable Python PoC for CVE-2026-31431 (Copy Fail)
CVE-2026-31431HIGHunder attack22 May 2026
crypto: algif_aead - Revert to operating out-of-place
100RISK
open
GitHub PoC
r3nsi15/CVE-2026-33017-langflow-rce
CVE-2026-33017CRITICALunder attack22 May 2026
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
100RISK
open
GitHub PoC
NullByte8080/CVE-2026-36226
CVE-2026-36226MEDIUM22 May 2026
Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensit
33RISK
open
GitHub PoC
NullByte8080/CVE-2026-36227
CVE-2026-36227MEDIUM22 May 2026
Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and e
33RISK
open
GitHub PoC
NullByte8080/CVE-2026-36228
CVE-2026-36228HIGH22 May 2026
Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execu
41RISK
open
GitHub PoC
CVE-2026-34926
CVE-2026-34926MEDIUMunder attack22 May 2026
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker t
68RISK
open
GitHub PoC3
eprocess offset puller for relevant member offsets and function addresses for cve-2026-40369
CVE-2026-40369HIGH22 May 2026
Windows Kernel Elevation of Privilege Vulnerability
41RISK
open
GitHub PoC2
Safely detect whether a PAN-OS target is vulnerable to CVE-2026-0265.
CVE-2026-0265HIGH22 May 2026
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
41RISK
open

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.